Cyber Security Academy · Lesson

DMARC Policy and Reporting

Enforcing alignment and reading reports.

DMARC Policy and Reporting is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What DMARC Adds

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and fixes their biggest blind spot.

SPF and DKIM each authenticate a domain, but not necessarily the visible From header the user sees. DMARC requires that authentication aligns with the From domain, and it tells receivers what to do when a message fails, plus it sends you reports.

The Concept of Alignment

Alignment is the heart of DMARC. A message passes DMARC only if it passes SPF or DKIM and that authenticated domain matches the visible From domain.

SPF alignment — the envelope MAIL FROM domain matches the From domain
DKIM alignment — the DKIM d= domain matches the From domain

This is what stops an attacker who passes SPF for their own domain while displaying your domain in From.

Strict vs Relaxed Alignment

Alignment can be checked in two modes, configured per mechanism:

Relaxed (default) — the organizational domains must match; subdomains are allowed (mail.company.com aligns with company.com)
Strict — the domains must match exactly

Relaxed is the practical default because organizations legitimately send from subdomains and via vendors. Strict offers tighter control where you can guarantee exact-domain signing.

The DMARC DNS Record

DMARC is published as a TXT record at the special _dmarc subdomain:

_dmarc.company.com.  IN  TXT \
  "v=DMARC1; p=reject; rua=mailto:dmarc@company.com; \
   ruf=mailto:forensic@company.com; pct=100; \
   adkim=r; aspf=r; fo=1"

Policy Tags Explained

The key DMARC tags control behavior and reporting:

p      policy: none | quarantine | reject
sp     policy for subdomains (defaults to p)
rua    address for aggregate reports
ruf    address for forensic (failure) reports
pct    percent of mail the policy applies to (rollout)
adkim  DKIM alignment mode: r (relaxed) | s (strict)
aspf   SPF alignment mode: r (relaxed) | s (strict)
fo     forensic report options

The Three Policy Levels

The p= tag tells receivers how to handle messages that fail DMARC:

p=none — take no action, just send reports (monitoring mode)
p=quarantine — treat failing mail as suspicious (route to spam)
p=reject — reject failing mail outright (strongest protection)

The goal of any deployment is to reach p=reject, which actually blocks spoofed mail. Starting there blindly, however, risks dropping legitimate mail.

Aggregate Reports (RUA)

Aggregate reports (sent to the rua address) are daily XML summaries from receiving providers. They show every source sending mail as your domain and whether each passed SPF, DKIM, and alignment.

These reports are how you discover:

Legitimate services you forgot to authorize
Spoofing attempts against your domain
Misconfigured senders before you enforce

They are the single most useful tool for a safe DMARC rollout.

Reading an Aggregate Report

Aggregate XML reports list source IPs with their authentication results:

<record>
  <row>
    <source_ip>198.51.100.4</source_ip>
    <count>120</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>pass</spf>
    </policy_evaluated>
  </row>
  <identifiers><header_from>company.com</header_from></identifiers>
</record>

Forensic Reports (RUF)

Forensic (failure) reports, sent to the ruf address, provide per-message detail about individual failures, including redacted headers.

They are useful for investigating active spoofing campaigns. However:

Many providers do not send them due to privacy concerns
They can contain sensitive recipient data, so handle carefully

In practice, aggregate (rua) reports do most of the heavy lifting; forensic reports are a bonus.

A Safe Rollout Path

Never jump straight to reject. Use a phased rollout driven by the reports:

Publish p=none with rua and monitor for weeks
Fix SPF and DKIM for every legitimate sender the reports reveal
Move to p=quarantine, optionally using pct to ramp gradually
When confident no legitimate mail fails, set p=reject

Each step is verified against aggregate reports before tightening further.

Subdomains and BIMI

Two practical points complete the picture:

Subdomain policy (sp) — set a policy for subdomains so attackers cannot spoof random.company.com. Use sp=reject even if a subdomain sends no mail.
BIMI — once you reach p=quarantine or p=reject, you can publish a BIMI record to display your verified logo in supporting inboxes, a business incentive to enforce DMARC.

Quick Check

Test your understanding of DMARC.

Recap

You learned how DMARC enforces and reports:

DMARC requires SPF or DKIM to align with the visible From domain
Alignment can be relaxed (subdomains allowed) or strict (exact match)
The p= policy escalates from none to quarantine to reject
Aggregate (rua) reports drive a safe, phased rollout; forensic (ruf) reports add per-message detail
Set a subdomain policy and consider BIMI once enforcing

This completes the Email Security course: SPF authorizes servers, DKIM signs messages, and DMARC ties them to the From and enforces policy.

Frequently asked questions

Is the “DMARC Policy and Reporting” lesson free?

Yes — the full text of “DMARC Policy and Reporting” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “DMARC Policy and Reporting”?

Enforcing alignment and reading reports. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “DMARC Policy and Reporting” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy