Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

DMARC enforced

Email spoofing protection (DMARC)

Can anyone send email that claims to come from this domain?

Why it matters

Without an enforced DMARC policy, receiving mail servers have no instruction to reject messages that forge the domain in the From line, so phishing that impersonates a ministry or a university lands in inboxes looking genuine. A policy of quarantine or reject applied to 100 percent of messages tells every receiver to stop them.

When a domain passes

Passes with exactly one DMARC record whose policy is quarantine or reject, applied to 100 percent of messages.

How to fix it

  1. Publish a DMARC TXT record on the domain, starting with the monitoring policy and an address that receives the aggregate reports.
  2. Read the reports for a few weeks to find every service that sends mail as the domain, and make each one pass SPF or DKIM.
  3. Move the policy to quarantine and then to reject, applied to all messages.
  4. A domain that never sends mail can go straight to reject, together with an SPF record that authorises no one.

An example record

_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Reference specifications

All thirteen standards