DMARC Email Authentication Setup for Sparkforge

Gmail and Yahoo now require DKIM and DMARC on bulk senders. If you send email through Sparkforge, you need a DMARC record published on your domain or your messages will land in spam — or get rejected outright.

What DMARC Does

DMARC (Domain-based Message Authentication, Reporting and Conformance) checks that incoming mail aligns with your published SPF and DKIM, then tells the receiving server what to do if it doesn't. Domain owners publish a single TXT record at _dmarc.yourdomain.com declaring the policy.

The three policy modes

• p=none — monitor only. Mail still flows. Use this while you watch reports.
• p=quarantine — failing mail goes to spam.
• p=reject — failing mail is dropped at the receiver. This is the goal once you trust your alignment.

Anatomy of a DMARC Record

A minimal record:

v=DMARC1; p=none;

Tags you can add

• v — protocol version. Always DMARC1.
• p — policy: none, quarantine, or reject.
• adkim — DKIM alignment. r (relaxed, default) or s (strict).
• aspf — SPF alignment. Same options as adkim.
• sp — policy for subdomains. Defaults to whatever p is.
• fo — when to send forensic reports: 0, 1, d, or s.
• ruf — mailto address for forensic reports.
• rua — mailto address for aggregate XML reports.
• rf — forensic report format. Default afrf.
• pct — percentage of failing mail the policy applies to (only meaningful with quarantine or reject).
• ri — aggregate report interval in seconds. Default 86400.

How DMARC Evaluates a Message

1. The receiving server checks SPF (Return-Path) and DKIM (d=) signatures.
2. It checks alignment — the SPF or DKIM domain must match the visible From domain (with relaxed or strict matching depending on your tags).
3. If alignment passes, the message passes DMARC. If it fails, your published policy (none, quarantine, or reject) decides what happens.
4. The receiver sends an aggregate report to the address in rua so you can see who's sending as you.

Recommended Rollout

1. Start with p=none and a rua address you actually read.
2. Watch reports for a few weeks. Identify legitimate senders failing alignment.
3. Move to p=quarantine with pct=10, then ramp up.
4. Move to p=reject once aggregate reports look clean.