Domain-based Message Authentication, Reporting & Conformance

Email is widely used not only for business and personal communications, but also by automatic systems that send you notifications and reminders triggered by your online activity. However, email is surprisingly vulnerable to impersonation attacks and online fraud. The origin of its vulnerability is that the information displayed in the “from” and “to” addresses are not necessarily where the email actually came from and who originated it.

Several attempts have been made over the years to validate that the person who sent an email is who they say they are. More recently a protocol called DMARC has been created to give a clear answer to the validation question.

DMARC (Domain-based Message Authentication, Reporting & Conformance) uses two previously defined protocols SPF and DKIM and allows domain owners to explicitly tell the receiving email server what to do with an email that fails an authentication attempt.