Chapter 9 : Is DMARC Reporting Required For MSPs To Have Happy Customers? Myths About DMARC Debunked

Five Myths About DMARC Debunked

There exist several widely believed perceptions on DMARC. Some of them are presented below, along with the correct explanation.

Myth 1 – Deploying DMARC is easy

DMARC reports are in XML format and a bit challenging to understand. It is also challenging to correlate the sending IP addresses with the organizations authorized to send emails on behalf of a domain.

Myth 2 – It prevents all kinds of email attacks

DMARC can stop phishing attacks that appear to originate from reputed domains. However, it does not provide defense against spear-phishing, look-alike domain spoof, and compromised accounts.

Myth 3 – Establishing a record of DMARC means it is protected

It is valid to a certain extent. However, it does not enforce any policy of its own. The organizations must specify in their record what to do with unauthenticated emails.

Myth 4 – DMARC is only needed for domains sending emails

It is not necessary. Malicious actors can impersonate any domain. Hence, it is essential to secure all of them by DMARC.

Myth 5 – DMARC is all you need

DMARC is the first step towards enforcing security for the email ecosystem. However, with technology advancing daily, there is scope for further development because new and more potent threats can emerge in the future.

The Purpose Of A DMARC Record

DMARC, in combination with SPF and DKIM, ensures the following.

• Authenticates the emails originating from a specific domain
• Introduces the element of trust signing the emails cryptographically
• Verify that emails have passed SPF and DKIM
• Tells receiving servers how to act if the messages fail DMARC (none, quarantine, or reject)

Is DMARC Reporting Necessary?

Yes, DMARC reporting is necessary as it protects domains against abuse. It also enables the website owners to ensure that their customers will only see those genuine emails arriving from an authorized domain.