跳到正文
DEV Community· Swift Labs·· 3 小時前AI 評分54

小型企業應先發布哪種 DMARC 記錄，以及何時收緊政策

The DMARC Record a Small Business Should Publish First (and When to Tighten It)

AI 導讀

指南建議小型企業先發布含 p=none 和 rua= 的 DMARC TXT 記錄，以監察哪些服務使用其網域寄信，同時不會阻擋郵件。先在 p=none 下收集 2-4 週報告，確認所有合法寄件服務均有 SPF 或 DKIM 通過並與寄件網域對齊。之後逐步將政策調至 quarantine，監察正常後再改為 reject。

正文

If your business sends mail from its own domain (you@yourbusiness.com), three DNS records do the authentication work: SPF, DKIM and DMARC. SPF and DKIM prove a message came from a server you actually use. DMARC tells the receiving server what to do when a message claims to be from your domain but fails those checks, and where to send reports about it.

With no DMARC record, anyone can put your domain in the From: line of a phishing email. The receiving server has no instructions from you, and you never hear about it.

Start with one TXT record

At your DNS host (Cloudflare, GoDaddy, Squarespace, Network Solutions, or wherever your DNS lives), add:

Host/Name: _dmarc
Type:      TXT
Value:     v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com

Swap in a mailbox you really own. Some providers want the full name _dmarc.yourbusiness.com instead of just _dmarc.

p=none is monitoring mode. Nothing gets blocked or sent to spam, so it can't break your mail. It just starts the reports flowing so you can see who is sending as your domain.

The tags, and what a small business should do with them

Tag Meaning Suggested setting
v=DMARC1 Marks the record as DMARC; must come first Always v=DMARC1
p= Policy for failing mail: none, quarantine (spam folder), reject (block) Start with none
rua= Where daily aggregate reports go A mailbox you own, or a monitoring service
pct= Share of failing mail the policy applies to Omit (defaults to 100) until you move to quarantine
sp= Policy for subdomains Omit; subdomains inherit p=
adkim= / aspf= Strict or relaxed alignment Omit; relaxed is the default and suits most setups
ruf= Per-message forensic reports Skip; few providers send them and they can include message content

Two mistakes that quietly make DMARC useless

1. p=none with no rua=. v=DMARC1; p=none; is valid but does nothing: no protection, no reports. Checkers still mark it "present", so it looks finished. Add a rua= address.

2. Two DMARC records. If _dmarc.yourbusiness.com has two TXT records starting with v=DMARC1, receivers treat the domain as having no DMARC at all. Merge them into one. This often happens when a website builder or email provider adds its own record next to yours.

Get SPF and DKIM right first

DMARC passes when a message passes SPF or DKIM and the passing domain matches the From: domain. Before tightening anything:

  • SPF: a single TXT record at the root of the domain starting with v=spf1, listing every service that sends as you (e.g. include:_spf.google.com for Google Workspace, include:spf.protection.outlook.com for Microsoft 365). Only one SPF record is allowed, and it has to stay under 10 DNS lookups.
  • DKIM: turn it on in your mail provider's admin console and publish the DNS records it gives you.

Then list everything else that sends as your domain: newsletter tool, invoicing or booking software, CRM, website contact forms. Each needs SPF or DKIM set up for your domain, or it will fail once you enforce DMARC.

Is DMARC required for a small sender?

Gmail's sender guidelines require everyone sending to personal Gmail accounts to use SPF or DKIM. Senders of more than 5,000 messages a day must also publish DMARC, and p=none is acceptable. Most small businesses are far below 5,000 a day, so strictly speaking they don't need it.

Google still recommends SPF, DKIM and DMARC for every domain, and DMARC reports are the only way to see who is sending mail under your name. It costs one DNS record, and at p=none there's no risk to your own mail.

Moving from p=none to quarantine and reject

Collect at least two to four weeks of reports at p=none, then:

  1. Confirm every legitimate sender passes. Each service you use should show SPF or DKIM passing and aligned in the reports. Fix the ones that don't.
  2. Step into quarantine gradually, e.g. v=DMARC1; p=quarantine; pct=25; rua=mailto:..., raising pct to 100 over a couple of weeks while you watch the reports.
  3. Switch to reject once quarantine at 100% has run cleanly: v=DMARC1; p=reject; rua=mailto:....

Reading the reports

Aggregate reports arrive as compressed XML attachments, typically one a day from each large mailbox provider that received your mail. They're painful to read by hand. You can parse them yourself, or point rua= at a service that reads them for you. DMARC allows several rua addresses separated by commas, so you can keep your own mailbox in the list.

Checklist

  • [ ] One TXT record at _dmarc.yourbusiness.com starting with v=DMARC1
  • [ ] p=none to start
  • [ ] rua=mailto: pointing at a mailbox you read, or a monitoring service
  • [ ] One SPF record, under 10 lookups, covering every sender
  • [ ] DKIM enabled with your mail provider and each sending tool
  • [ ] 2-4 weeks of reports reviewed before p=quarantine

Sources: Gmail email sender guidelines (support.google.com/a/answer/81126); DMARC tag definitions and multiple-record handling per RFC 7489 §6.3 and §6.6.3.

Originally published on Email DNS Check, a free SPF/DKIM/DMARC checker by Swift Labs. We also build MailGuard, which reads DMARC reports and sends a plain-English weekly summary ($7/domain/month, 14-day trial).

This article was created with the help of AI and checked for accuracy before publishing.

來源：DEV Community · dev.to

#教學/實踐