DMARC without breaking your own mail
My app sends invitation, password-reset and alert emails, and for a long time nothing seemed wrong with them. They were sent, they mostly arrived, and the DMARC record said p=none . That setting tells receivers to do nothing about mail that fails authentication, so a forged email claiming to come from my domain got delivered exactly as often as a real one. Anyone could have sent a password-reset…
My application sends various types of emails, such as invitations, password resets, and alerts. Initially, the DMARC record was set to p=none, meaning that failing authentication would not result in any action being taken. This allowed forged emails to be delivered without any issues, as anyone could send a password reset email in the app's name.
DMARC records consist of three main components: SPF, DKIM, and the policy itself (p=). SPF lists the servers allowed to send emails for a domain, DKIM adds a signature to each message, and p= determines how receivers should handle emails that fail authentication.
After monitoring the daily reports, it was discovered that the SPF record had several issues due to nested includes, resulting in a high number of DNS lookups. Flattening the record reduced the number of lookups needed and brought it within the acceptable limit of ten. The private key used for DKIM signing was also verified to ensure it matched the public key published in DNS.
The DMARC policy was then moved from p=none to p=quarantine, which sends failing emails to the spam folder instead of blocking them outright. Finally, the policy was set to p=reject, which completely blocks any emails that fail authentication.
Throughout this process, daily reports were reviewed to ensure that the setup was working as expected. Despite using Google's DMARC reports, there was no information available regarding mail sent to other email providers like Outlook, Yahoo, or company mailboxes. The implementation was completed within a few days, with a rollback plan in case of any issues.
However, it is important to note that the reports only showed mail sent through Google's servers, and further verification is needed for mail sent via other email providers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
