Which DNS record is used to publish a policy that combines SPF and DKIM results to handle unauthenticated emails?

Which DNS record is used to publish a policy that combines SPF and DKIM results to handle unauthenticated emails?

• A. SPF
• B. DKIM
• C. DMARC
• D. TXT

Answer: (C)

DMARC is the mechanism that lets a domain publish a policy for what to do with emails that fail SPF or DKIM checks and don’t align with the From header. It sits on top of SPF and DKIM, using their results plus alignment to decide actions such as none, quarantine, or reject. The policy is published in DNS as a TXT record under the _dmarc subdomain of the domain, typically starting with v=DMARC1 and including the p= policy and optional reporting and alignment settings. SPF and DKIM by themselves verify provenance; DMARC ties those results together and tells receivers how to handle messages that don’t pass authentication.

DMARC is the mechanism that lets a domain publish a policy for what to do with emails that fail SPF or DKIM checks and don’t align with the From header. It sits on top of SPF and DKIM, using their results plus alignment to decide actions such as none, quarantine, or reject. The policy is published in DNS as a TXT record under the _dmarc subdomain of the domain, typically starting with v=DMARC1 and including the p= policy and optional reporting and alignment settings. SPF and DKIM by themselves verify provenance; DMARC ties those results together and tells receivers how to handle messages that don’t pass authentication.