Domain-based Message Authentication, Reporting, and Conformance (DMARC)
RFC 7489

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07
• 08
• 09
• 10
• 11
• 12
• 13

Independent Submission                                 M. Kucherawy, Ed.
Request for Comments: 7489
Category: Informational                                   E. Zwicky, Ed.
ISSN: 2070-1721                                                   Yahoo!
                                                              March 2015

Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Abstract

   Domain-based Message Authentication, Reporting, and Conformance
   (DMARC) is a scalable mechanism by which a mail-originating
   organization can express domain-level policies and preferences for
   message validation, disposition, and reporting, that a mail-receiving
   organization can use to improve mail handling.

   Originators of Internet Mail need to be able to associate reliable
   and authenticated domain identifiers with messages, communicate
   policies about messages that use those identifiers, and report about
   mail using those identifiers.  These abilities have several benefits:
   Receivers can provide feedback to Domain Owners about the use of
   their domains; this feedback can provide valuable insight about the
   management of internal operations and the presence of external domain
   name abuse.

   DMARC does not produce or encourage elevated delivery privilege of
   authenticated email.  DMARC is a mechanism for policy distribution
   that enables increasingly strict handling of messages that fail
   authentication checks, ranging from no action, through altered
   delivery, up to message rejection.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This is a contribution to the RFC Series, independently of any other
   RFC stream.  The RFC Editor has chosen to publish this document at
   its discretion and makes no statement about its value for
   implementation or deployment.  Documents approved for publication by
   the RFC Editor are not a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7489.

Kucherawy & Zwicky            Informational                     [Page 1]
RFC 7489                          DMARC                       March 2015

Copyright Notice

   Copyright (c) 2015 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.

Table of Contents

   1. Introduction ....................................................3
   2. Requirements ....................................................5
      2.1. High-Level Goals ...........................................5
      2.2. Out of Scope ...............................................6
      2.3. Scalability ................................................6
      2.4. Anti-Phishing ..............................................7
   3. Terminology and Definitions .....................................7
      3.1. Identifier Alignment .......................................8
      3.2. Organizational Domain .....................................11
   4. Overview .......................................................12
      4.1. Authentication Mechanisms .................................12
      4.2. Key Concepts ..............................................12
      4.3. Flow Diagram ..............................................13
   5. Use of RFC5322.From ............................................15
   6. Policy .........................................................15
      6.1. DMARC Policy Record .......................................16
      6.2. DMARC URIs ................................................16
      6.3. General Record Format .....................................17
      6.4. Formal Definition .........................................21
      6.5. Domain Owner Actions ......................................22
      6.6. Mail Receiver Actions .....................................23
      6.7. Policy Enforcement Considerations .........................27
   7. DMARC Feedback .................................................28
      7.1. Verifying External Destinations ...........................28
      7.2. Aggregate Reports .........................................30
      7.3. Failure Reports ...........................................36
   8. Minimum Implementations ........................................37
   9. Privacy Considerations .........................................38
      9.1. Data Exposure Considerations ..............................38
      9.2. Report Recipients .........................................39