Configure DMARC policies with MailOut
Last updated on
A DMARC policy is used to reduce fraudulent behaviour using email. There are a broad range of parameter settings to harden your DNS setup using DMARC.
In general, your DMARC record must start with the attribute “v=DMARC1”.
To successfully validate the DNS Records for your sending domain with STACKIT MailOut, you must set the “p” attribute to clarify the behaviour for your sending domain.
| Mode | Description |
|---|---|
| p=‘none’ | This setting tells the receiving server to take no actions for unauthenticated emails. |
| p=‘quarantine’ | Unauthenticated emails are flagged as suspicious or marked as spam by the receiving server. |
| p=‘reject’ | The receiving server is instructed to reject emails that fail the DMARC check. |
In addition, you can also define the behaviour for subdomains with the attribute “sp” of the DMARC record.
| Mode | Description |
|---|---|
| sp=‘none’ | This setting tells the receiving server to take no actions for unauthenticated emails. |
| sp=‘quarantine’ | Unauthenticated emails are flagged as suspicious or marked as spam by the receiving server. |
| sp=‘reject’ | The receiving server is instructed to reject emails that fail the DMARC check. |
Customers are responsible to set an appropriate DMARC policy on their own. STACKIT MailOut will accept settings “none”, “quarantine” and “reject” for parameter “p” and “sp”. The “none” mode is recommended for testing purposes only.
A recommended DMARC DNS record should at least look like this:
Once you are completely confident that your p=quarantine rollout is working flawlessly, it’s time to transition to p=reject. Making this move unlocks the highest tier of email security, providing the absolute strongest defense against domain spoofing and phishing attacks.