DMARC can make emails more trustworthy

Last week, a workinggroup of 15 notable members presented DMARC to the public. DMARC stands for Domain-based Message
Authentication, Reporting and Conformance. It’s a further step forward towards making email-spoofing less attractive for fraudsters.

The facts:

• Founded by: Google, Facebook, Microsoft, Yahoo, PayPal, AOL, Bank of America, Fidelity Investments, American Greetings, LinkedIn, Agari, Cloudmark, eCert, Return Path and the Trusted Domain Project.
• Builds up on SPF and DKIM, two main email authentication standards.
• Offers email senders new insights on what’s going on behind the scenes by delivering XML-reportings which contain:
  • Every IP address using their domain to send email
  • A count of messages from each of those IP addresses
  • What was done with these messages per the DMARC policy shown (accepted/rejected/…)
  • SPF results for these messages
  • DKIM results for these messages
• Needs adopters to setup a DMARC TXT Resource Record in the DNS. It may look like this:
  

  v=DMARC1; p=reject\; rua=mailto:postmaster@emailmarketingtipps.de\; ruf=mailto:postmaster@emailmarketingtipps.de\; rf=afrf\; pct=100\;

  (Return Path offers a tool to build a record)

How DMARC authentification works (Source: DMARC:org)

The draft specification is going through a test-phase now and. It is supposed to be standardized by the IETF afterwards. Visit the official projects’ homepage at DMARC.org.

It is not yet know if adopters benefit from additional trust anchors in the inbox. Like the golden key in Gmail (PayPal, eBay) or like the blue at-symbol from trustedDialog in Germany (see figure below). Depending on the adoption rate this may provide senders with a higher visibility and higher response rates. But the signs are good as major email providers are in the boat I’d say …

The blue trustedDialog-icon shows successful authentification in GMX, Web.de, T-Online and Freenet (= 75 % market share of primarily used GER-email providers)

Further readings:

• MSDN: New email authentication protocol – DMARC
• Return Path: DMARC.org: A Giant Step Forward in the Fight Against Phishing
• Facebook: Building Open-Source Email Authentication Technologies
• Yahoo: Joining Together in the Fight Against Phishing
• MSDN: New email authentication protocol – DMARC
• Return Path: DMARC.org: A Giant Step Forward in the Fight Against Phishing
• Gmail: Landing another blow against email phishing