<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-dmarc-enforcement
description: >-
  Deploy and enforce DMARC policies from monitoring through full rejection.
  Covers SPF/DKIM alignment, DMARC record configuration, aggregate and
  forensic report analysis, phased rollout strategy, and third-party
  sender authorization.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - dmarc
  - spf
  - dkim
  - email-authentication
  - dns
  - email-security
  - dmarc-enforcement
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Implementing DMARC Enforcement

## Overview

DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents
domain spoofing by linking SPF and DKIM authentication to the visible From header.
This skill covers the full lifecycle from initial monitoring (`p=none`) through
enforcement (`p=reject`), including aggregate report analysis, third-party sender
authorization, and SPF record optimization.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `dig` / `nslookup` | DNS record queries |
| DNS zone access | Ability to publish TXT records |
| DMARC report parser | `pip install parsedmarc` |
| Mail server admin | SPF/DKIM key management |

## Key Concepts

### DMARC Alignment

```
SPF Alignment:  RFC5321.MailFrom domain matches RFC5322.From domain
DKIM Alignment: DKIM d= domain matches RFC5322.From domain

Alignment Modes:
├── strict (s)  — exact domain match required
└── relaxed (r) — organizational domain match (subdomain OK)

Example:
  From: user@mail.company.com
  SPF:  envelope from mail.company.com → relaxed pass, strict fail vs company.com
  DKIM: d=company.com → relaxed pass for mail.company.com
```

### DMARC Record Tags

| Tag | Values | Description |
|---|---|---|
| `v` | `DMARC1` | Version (required) |
| `p` | `none`, `quarantine`, `reject` | Policy for domain |
| `sp` | `none`, `quarantine`, `reject` | Subdomain policy |
| `rua` | `mailto:dmarc@domain.com` | Aggregate report URI |
| `ruf` | `mailto:forensic@domain.com` | Forensic report URI |
| `pct` | `1-100` | Percentage to apply policy |
| `adkim` | `r`, `s` | DKIM alignment mode |
| `aspf` | `r`, `s` | SPF alignment mode |
| `fo` | `0`, `1`, `d`, `s` | Forensic report options |
| `ri` | seconds | Aggregate report interval |

### Rollout Phases

```
Phase 1: Monitor          v=DMARC1; p=none; rua=mailto:dmarc@company.com
  └── Duration: 2-4 weeks — identify all legitimate senders

Phase 2: Soft Quarantine   v=DMARC1; p=quarantine; pct=10; rua=...
  └── Duration: 2 weeks — quarantine 10% of failures

Phase 3: Full Quarantine   v=DMARC1; p=quarantine; pct=100; rua=...
  └── Duration: 2 weeks — quarantine all failures

Phase 4: Soft Reject       v=DMARC1; p=reject; pct=25; rua=...
  └── Duration: 2 weeks — reject 25% of failures

Phase 5: Full Reject       v=DMARC1; p=reject; rua=...
  └── Ongoing — full enforcement
```

## Workflow

### 1. Assess Current State

```bash
# Check existing SPF record
dig TXT company.com | grep spf

# Check existing DKIM selector
dig TXT selector1._domainkey.company.com

# Check existing DMARC record
dig TXT _dmarc.company.com

# Automated assessment
node agent.js assess company.com
```

### 2. Configure SPF

```bash
# SPF record — include all legitimate senders
# v=spf1 include:_spf.google.com include:spf.protection.outlook.com
#   include:sendgrid.net include:servers.mcsv.net -all

# Validate SPF record (must stay under 10 DNS lookups)
node agent.js check-spf company.com

# Common includes:
# Google Workspace: include:_spf.google.com
# Microsoft 365:    include:spf.protection.outlook.com
# SendGrid:         include:sendgrid.net
# Mailchimp:        include:servers.mcsv.net
# Salesforce:       include:_spf.salesforce.com
```

### 3. Deploy DKIM

```bash
# Generate DKIM key pair (2048-bit RSA minimum)
openssl genrsa -out dkim_private.pem 2048
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

# Publish public key as DNS TXT record:
# selector1._domainkey.company.com TXT "v=DKIM1; k=rsa; p=<public_key_base64>"

# Verify DKIM DNS record
dig TXT selector1._domainkey.company.com
```

### 4. Publish DMARC and Monitor

```bash
# Phase 1: monitoring mode
# _dmarc.company.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-rua@company.com; ruf=mailto:dmarc-ruf@company.com; fo=1"

# Parse aggregate reports
parsedmarc -i /tmp/dmarc_reports/ -o /tmp/parsed_reports/

# Analyze reports with agent
node agent.js analyze-reports /tmp/dmarc_reports/

# Progress through enforcement phases
node agent.js recommend company.com
```

## Detection

```yaml
title: Dmarc Enforcement Detection
id: 14ee0bb4-d3da-4a31-a1f6-ff18c8c6a320
status: experimental
description: Detects suspicious activity related to implementing dmarc enforcement techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| SPF record valid | `dig TXT domain.com` — valid syntax, `-all` |
| SPF lookup count ≤ 10 | `node agent.js check-spf domain.com` |
| DKIM key published | `dig TXT selector._domainkey.domain.com` — valid key |
| DMARC record valid | `dig TXT _dmarc.domain.com` — correct syntax |
| DMARC at enforcement | Policy is `p=reject` or `p=quarantine` |
| Reports flowing | Aggregate reports received at `rua` address |
| All senders authorized | No legitimate senders failing alignment |

## References

- [RFC 7489 — DMARC](https://datatracker.ietf.org/doc/html/rfc7489)
- [RFC 7208 — SPF](https://datatracker.ietf.org/doc/html/rfc7208)
- [RFC 6376 — DKIM](https://datatracker.ietf.org/doc/html/rfc6376)
- [NIST SP 800-177 Rev 1 — Trustworthy Email](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
- [parsedmarc Documentation](https://domainaware.github.io/parsedmarc/)
- [dmarcian DMARC Guide](https://dmarcian.com/dmarc-inspector/)
