hmLoadTopic({
hmKeywords:"DMARC,DMARC and Mailing Lists,DMARC Creating a DNS record,DMARC DNS record,DMARC Overview,DNS,DNS DMARC Record,Mailing Lists,Mailing Lists DMARC",
hmTitle:"DMARC",
hmDescription:"Domain-based Message Authentication, Reporting & Conformance (DMARC) is a specification designed to help reduce email message abuse, such as incoming spam and phishing messages...",
hmPrevLink:"security--arc_settings.html",
hmNextLink:"security--dmarc_verification.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > DMARC",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">DMARC<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText\"><span class=\"f_BodyText\">Domain-based Message Authentication, Reporting &amp; Conformance (DMARC) is a specification designed to help reduce email message abuse, such as incoming spam and phishing messages that misrepresent their origins by forging the message\'s <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header. DMARC makes it possible for domain owners to use the Domain Name System (DNS) to inform receiving servers of their DMARC policy, which is how they want those servers to handle messages that purport to be sent from their domain but cannot be authenticated as having actually come from it. This policy, which is retrieved by the receiving server via a DNS query while processing the incoming message, can state that the server should quarantine or reject messages that do not align with the policy, or take no action at all (i.e. let the message proceed normally). In addition to the policy, the domain\'s DMARC DNS record can also contain requests for the server to send DMARC reports to some, outlining the number of incoming messages purporting to be from that domain and whether or not they passed or failed authentication, and with details about any failures. DMARC\'s reporting features can be useful for determining the effectiveness of your email authentication procedures and how frequently your domain name is being used in forged messages.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Under the Sender Authentication section of the Security Settings dialog, there are three screens for configuring MDaemon\'s DMARC verification and reporting features: DMARC Verification, DMARC Reporting, and DMARC Settings.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\"><a href=\"security--dmarc_verification.html\" class=\"topiclink\">DMARC Verification<\/a><\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">As part of the DMARC verification process, MDaemon performs a DMARC DNS query on the domain found in the <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header of each incoming message. This is done to determine whether or not the domain uses DMARC, and if so, to retrieve its <a href=\"security--dmarc.html#dmarc-dns-record\" class=\"topiclink\">DMARC DNS record<\/a>, which contains its policy and other DMARC related information. Additionally, DMARC utilizes <a href=\"security--spf__sender_id.html\" class=\"topiclink\">SPF<\/a> and <a href=\"security--dkim_verify.html\" class=\"topiclink\">DKIM<\/a> to validate each message and requires it to pass at least one of those tests in order to pass DMARC verification. If the message passes then it will proceed normally through the rest of MDaemon\'s delivery and filtering processes. If it fails, however, then the fate of the message is determined by a combination of the domain\'s DMARC policy and how you have configured MDaemon to deal with those messages.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">If a message fails DMARC verification and the DMARC domain has a policy of &quot;<\/span><span class=\"f_PlainText\">p=none<\/span><span class=\"f_BodyText\">&quot; then no punitive action will be taken and normal message processing will continue. Conversely, when the DMARC domain has a restrictive policy of &quot;<\/span><span class=\"f_PlainText\">p=quarantine<\/span><span class=\"f_BodyText\">&quot; or &quot;<\/span><span class=\"f_PlainText\">p=reject<\/span><span class=\"f_BodyText\">,&quot; MDaemon can optionally filter the message automatically to the receiving user\'s <\/span><span class=\"f_Comment\">spam<\/span><span class=\"f_ControlIndent\"> (i.e. junk e-mail) <\/span><span class=\"f_BodyText\">folder. You can also choose to have MDaemon reject the failed message completely when the domain is using the &quot;<\/span><span class=\"f_PlainText\">p=reject<\/span><span class=\"f_BodyText\">&quot; policy. Additionally for failed messages with restrictive policies, MDaemon will insert the &quot;<\/span><span class=\"f_PlainText\">X-MDDMARC-Fail-policy: quarantine<\/span><span class=\"f_BodyText\">&quot; or &quot;<\/span><span class=\"f_PlainText\">X-MDDMARC-Fail-policy: reject<\/span><span class=\"f_BodyText\">&quot; header, depending on the policy. This makes it possible for you to <\/span><span class=\"f_ControlIndent\">use the Content Filter to perform some action based on the presence of those headers, such as sending the message to a specific folder for further scrutiny.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_ControlIndent\">DMARC Verification is enabled by default and recommended for most MDaemon configurations.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\"><a href=\"security--dmarc_reporting.html\" class=\"topiclink\">DMARC Reporting<\/a><\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When MDaemon queries DNS for a DMARC record, the record may contain tags indicating that the domain owner wishes to receive DMARC aggregate or failure reports regarding messages claiming to be from that domain. The options on the DMARC Reporting screen are for designating whether or not you are willing to send the requested types of reports, and for specifying the meta-data those reports should contain. Aggregate reports are sent daily at Midnight UTC and failure reports are sent per message, as each incident occurs that triggers the report. Reports are always sent as zipped XML file attachments, and there are various parsing tools available online that can make them easy for the recipients to view.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">By default MDaemon does not send aggregate or failure reports. If you are willing to send either type of report, enable its corresponding options on the DMARC Reporting screen.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\"><a href=\"security--dmarc_options.html\" class=\"topiclink\">DMARC Settings<\/a><\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">The DMARC Settings<\/span><span class=\"f_BodyText\"> screen contains various options for including certain info in DKIM reports, logging DMARC DNS records, and updating the Public Suffix file used by MDaemon for DMARC.<\/span><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">DMARC Verification and Mailing Lists<\/span><\/h2>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Because the purpose of DMARC is to ensure that the domain found in a message\'s <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header hasn\'t been forged, the sending server must be permitted to send messages on behalf of that domain. This can pose a unique problem for mailing lists, because it is common for lists to distribute messages on behalf of list members from outside domains, and yet leave the <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header unchanged. This means that when a receiving server attempts to use DMARC verification on one of these messages, the message will have been sent by a server that is not officially affiliated with the <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header domain. If the DMARC domain happens to be using a restrictive DMARC policy, this could cause the message to be quarantined or even rejected by the receiving server. In some cases this could also cause the recipient to be removed from the list\'s membership. To circumvent this problem, when MDaemon finds that a messages for a list is coming from a domain with a restrictive DMARC policy, MDaemon will replace the message\'s <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header with the mailing list\'s address. Alternatively, you can configure MDaemon to refuse to accept any message for a list when it is from a domain with a restrictive policy. This latter option would effectively make it impossible for a user from a domain with a restrictive policy to post a message to the list. The option to replace the <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_BodyText\"> header is located on the mailing list editor\'s <a href=\"ml_headers.html\" class=\"topiclink\">Headers<\/a> screen. The option to reject messages is located on the <a href=\"ml_options.html\" class=\"topiclink\">Settings<\/a> screen.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"dmarc-dns-record\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">Using DMARC for Your MDaemon Domains<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">If you would like to use DMARC for one of your own domains, meaning that you want receiving mail servers that support DMARC to use DMARC to verify messages claiming to be from you, then you must first ensure that you have created properly formatted SPF and DKIM DNS records for the domain; you must have at least one of those options working correctly to use DMARC. If you are using DKIM then you must also configure MDaemon\'s <a href=\"security--dkim_sign.html\" class=\"topiclink\">DKIM Signing<\/a> options to sign the domain\'s messages. Additionally, you must create a DMARC DNS record for the domain. By querying DNS for this specially formatted <\/span><span class=\"f_PlainText\">TXT<\/span><span class=\"f_BodyText\"> record, the receiving server can determine your DMARC policy and various optional parameters such as: the mode of authentication you use, whether or not you wish to receive aggregate reports, the email address to which reports should be sent, and others.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Once you have properly configured DMARC and have begun to receive DMARC XML reports, there are a variety of online tools you can use to read those reports and diagnose any potential problems. For your convenience there is also a DMARC Reporter tool provided for you in the \\MDaemon\\App\\ folder. See DMARCReporterReadMe.txt for instructions on how to use it.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Defining a DMARC TXT Resource Record<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">The following is an overview of the most basic, commonly used components of a DMARC record. For more detailed information, or for information on more advanced configurations, see: <a href=\"http:\/\/www.dmarc.org\" target=\"_blank\" class=\"weblink\">www.dmarc.org<\/a>. <\/span><\/p>\n\r<h4 class=\"p_Heading4\" style=\"page-break-after: avoid;\"><span class=\"f_Heading4\">Owner Field<\/span><\/h4>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">The Owner (also called &quot;Name&quot; or &quot;left-hand&quot;) field of the DMARC resource record must always be <\/span><span class=\"f_PlainText\" style=\"font-weight: bold;\">_dmarc<\/span><span class=\"f_BodyText\">, or it can take the form <\/span><span class=\"f_PlainText\" style=\"font-weight: bold;\">_dmarc.domain.name<\/span><span class=\"f_BodyText\"> if you wish to specify the domain or subdomain to which the record applies.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Example:<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">DMARC record for the domain <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">example.com<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_PlainText\">_dmarc IN TXT &quot;v=DMARC1;p=none&quot;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This record would apply to emails from user@example.com or any subdomains of example.com, such as user@support.example.com, user@mail.support.example.com, and so on.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_PlainText\">_dmarc.support.example.com IN TXT &quot;v=DMARC1;p=none&quot;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This record would only apply to emails from user@support.example.com, not to emails from, for example, user@example.com.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_PlainText\">_dmarc.support IN TXT &quot;v=DMARC1;p=none&quot;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This record would apply to emails from: user@support.example.com, user@a.support.example.com, user@a.b.support.example.com, and so on.<\/span><\/p>\n\r<h4 class=\"p_Heading4\" style=\"page-break-after: avoid;\"><span class=\"f_Heading4\">DMARC Record Tags and Values<\/span><\/h4>\n\r<h4 class=\"p_Heading4\" style=\"page-break-after: avoid;\"><span class=\"f_Heading4\">Required Tags<\/span><\/h4>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0.6250rem 0.7500rem 0.6250rem;\"><table style=\"width:100%; border:solid 0.1250rem #ebebeb; border-spacing:0; border-collapse:collapse;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; background-color:#E1DBDB; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Tag<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; background-color:#E1DBDB; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Value<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; background-color:#E1DBDB; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Notes<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">v=<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">DMARC1<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_Notes\"><span class=\"f_Notes\">The is the Version tag, which must be the first tag in the DMARC specific text portion of the record. Although other DMARC tag values are not case sensitive, the value of the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">v=<\/span><span class=\"f_Notes\"> tag must have the uppercase value: <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">DMARC1<\/span><span class=\"f_Notes\">.<\/span><\/p>\n\r<p class=\"p_Normal\">Example:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=none&quot;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">p=<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">none<\/span><\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">quarantine<\/span><\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">reject<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_Notes\"><span class=\"f_Notes\">This is the Policy tag, which must be the second tag in the DMARC record, following the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">v=<\/span><span class=\"f_Notes\"> tag.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\" style=\"font-weight: bold;\">p=none<\/span><span class=\"f_Notes\"> means that the receiving server should take no action based on results of the DMARC query. Messages that fail the DMARC check should not be quarantined or rejected based on that failure. They could still be quarantined or rejected for other reasons, such as for failing spam filter tests or other security checks unrelated to DMARC. Using <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">p=none<\/span><span class=\"f_Notes\"> is sometimes called &quot;monitoring&quot; or &quot;monitor mode&quot; because you can use it with the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">rua=<\/span><span class=\"f_Notes\"> tag to receive aggregate reports from recipient domains about your messages, but those messages will not be penalized by the domains for failing to pass the DMARC check. This is the policy to use until you have thoroughly tested your DMARC implementation and are sure you are ready to move on to the more restrictive <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">p=quarantine<\/span><span class=\"f_Notes\"> policy.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\" style=\"font-weight: bold;\">p=quarantine<\/span><span class=\"f_Notes\"> is the policy to use when you want other mail servers to treat a message as suspicious when its <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">From:<\/span><span class=\"f_Notes\"> header says that it is coming from you but the message fails the DMARC check. Depending upon the server\'s local policy, this could mean subjecting the message to additional scrutiny, placing it into the recipient\'s <\/span><span class=\"f_Notes\">spam folder, routing it to a different server, or taking some other action.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\" style=\"font-weight: bold;\">p=reject<\/span><span class=\"f_Notes\"> indicates that you want the receiving server to reject any message that fails DMARC verification. Some servers, however, may still accept these message but quarantine them or subject them to additional scrutiny. This is the most restrictive policy and should generally not be used unless you have total confidence about your email policies and the types of messages or services you wish to allow your accounts to use. For example, if you wish to allow your users to join 3rd party mailing lists, use mail forwarding services, utilize &quot;share this&quot; features on websites, or the like, then using <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">p=reject<\/span><span class=\"f_Notes\"> would almost certainly cause some legitimate messages to be rejected. It could also cause some users to be automatically dropped or banned from certain mailing lists.<\/span><\/p>\n\r<p class=\"p_Normal\">Example:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=quarantine;rua=mailto:dmarc-report@example.net&quot;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h4 class=\"p_Heading4\" style=\"page-break-after: avoid;\"><span class=\"f_Heading4\">Optional Tags<\/span><\/h4>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">All of the tags listed below are optional. When any of these tags are not used in a record then their default values are assumed. <\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0.6250rem 0.7500rem 0.6250rem;\"><table style=\"width:100%; border:solid 0.1250rem #ebebeb; border-spacing:0; border-collapse:collapse;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; background-color:#E1DBDB; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Tag<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; background-color:#E1DBDB; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Value<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; background-color:#E1DBDB; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Notes<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">sp=<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">none<\/span><\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">quarantine<\/span><\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">reject<\/span><\/p>\n\r<p class=\"p_Normal\">—<\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Default:<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">If <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">sp=<\/span><span class=\"f_BodyText\"> is not used, the <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">p=<\/span><span class=\"f_BodyText\"> tag applies to the domain and subdomains.<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_Notes\"><span class=\"f_Notes\">This tag is for specifying a policy to be used for subdomains of the domain to which the DMARC record applies. For example, if this tag is used in a record that has scope over example.com, then the policy designated in the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">p=<\/span><span class=\"f_Notes\"> tag will apply to messages from example.com and the policy designated in the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">sp=<\/span><span class=\"f_Notes\"> tag will apply to messages from subdomains of example.com, such as mail.example.com. If this tag is omitted from the record, the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">p=<\/span><span class=\"f_Notes\"> tag will apply to the domain and its subdomains.<\/span><\/p>\n\r<p class=\"p_Normal\">Example:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=quarantine;sp=reject&quot;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">rua=<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\" style=\"font-weight: normal;\">Comma-separated list of email addresses to which DMARC aggregate reports should be sent. The addresses must entered as URIs in the form:<\/span><br \/>\n\r<span class=\"f_NormalHead\">mailto:user@example.com<\/span><\/p>\n\r<p class=\"p_Normal\">—<\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Default: none<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">If this tag is not used then no aggregate reports will be sent.<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_Notes\"><span class=\"f_Notes\">This tag indicates that you wish to receive DMARC aggregate reports from servers who receive messages claiming to be <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">From:<\/span><span class=\"f_Notes\"> a sender at your domain. Specify one or more email addresses as URIs in the form: <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">mailto:user@example.com<\/span><span class=\"f_Notes\">, separating multiple URIs with commas.<\/span><\/p>\n\r<p class=\"p_Normal\">Example:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=quarantine;rua=mailto:user01@example.com,mailto:user02@example.com&quot;<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">Ordinarily these addresses will be at the domain covered by this record. If you wish to send reports to an address at some other domain, then that domain\'s DNS zone file must also contain a special DMARC record indicating that it will accept DMARC reports for the domain.<\/span><\/p>\n\r<p class=\"p_Normal\">Example record at example.com:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=quarantine;rua=mailto:non-local-user@example.net&quot;<\/span><\/p>\n\r<p class=\"p_Normal\">Required record at example.net:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">example.com._report._dmarc TXT &quot;v=DMARC1&quot;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:2.6250rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">ruf=<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:6.0000rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\" style=\"font-weight: normal;\">Comma-separated list of email addresses to which DMARC failure reports should be sent. The addresses must entered as URIs in the form:<\/span><br \/>\n\r<span class=\"f_NormalHead\">mailto:user@example.com<\/span><\/p>\n\r<p class=\"p_Normal\">—<\/p>\n\r<p class=\"p_NormalHead\" style=\"page-break-after: avoid;\"><span class=\"f_NormalHead\">Default: none<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">If this tag is not used then no failure reports will be sent.<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:27.4375rem; padding:0.3125rem; border:solid thin #ebebeb;\"><p class=\"p_Notes\"><span class=\"f_Notes\">This tag indicates that you wish to receive DMARC failure reports from servers who receive messages claiming to be <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">From:<\/span><span class=\"f_Notes\"> a sender at your domain, when the conditions specified in the <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">fo=<\/span><span class=\"f_Notes\"> tag have been met. By default, when there is no <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">fo=<\/span><span class=\"f_Notes\"> tag specified, failure reports are sent when the message fails all DMARC verification checks (i.e. fails both SPF and DKIM). Specify one or more email addresses as URIs in the form: <\/span><span class=\"f_Notes\" style=\"font-weight: bold;\">mailto:user@example.com<\/span><span class=\"f_Notes\">, separating multiple URIs with commas.<\/span><\/p>\n\r<p class=\"p_Normal\">Example:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=quarantine;ruf=mailto:dmarc-failures@example.com&quot;<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">Ordinarily these addresses will be at the domain covered by this record. If you wish to send reports to an address at some other domain, then that domain\'s DNS zone file must also contain a special DMARC record indicating that it will accept DMARC reports for the domain.<\/span><\/p>\n\r<p class=\"p_Normal\">Example record at example.com:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">_dmarc IN TXT &quot;v=DMARC1;p=quarantine;ruf=mailto:non-local-user@example.net&quot;<\/span><\/p>\n\r<p class=\"p_Normal\">Required record at example.net:<\/p>\n\r<p class=\"p_ExampleIndent2\"><span class=\"f_ExampleIndent2\">example.com._report._dmarc TXT &quot;v=DMARC1&quot;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\"> For more extensive information on the DMARC specification, see: <a href=\"http:\/\/www.dmarc.org\" target=\"_blank\" class=\"weblink\">www.dmarc.org<\/a>.<\/span><\/p>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_verification.html\" class=\"topiclink\">DMARC Verification<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_reporting.html\" class=\"topiclink\">DMARC Reporting<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_options.html\" class=\"topiclink\">DMARC Settings<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ml_options.html\" class=\"topiclink\">Mailing List » Settings<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ml_headers.html\" class=\"topiclink\">Mailing List » Headers<\/a><\/span><\/p>\n\r"
})
