DMARC Email Project

ITS will implement DMARC (Domain-based Message Authentication, Reporting and Conformance) on its email system, a policy and reporting protocol for email authentication. Implementing DMARC protects users by combating phishing, email scams, and spoofing of our email domains.

Why implement DMARC?

Email technology continues to evolve and DMARC has become one of the common solutions to verify email messages are legitimate.

• Provides separation of approved and unapproved email messages. Without DMARC, it is possible for fraudulent spoofing of our university email domains. Properly implementing DMARC technology adds credibility to university messages.
• DMARC has become an industry standard technology with large providers such as Google/Gmail, and some government agencies, requiring systems to implement the protocols. To continue successfully communicating with these providers, we must adapt.
• Participating in DMARC compliance will help increase overall email authentication. As other organizations implement similar changes, phishing and other inappropriate spoofing will become less effective.

What is DMARC and how does it work?

DMARC provides protection against spam and phishing emails and other spoofing attempts by adding an encrypted DKIM (DomainKeys Identified Message) signature and/or SPF (Sender Policy Framework) to verify the authenticity of any sender attempting to use the @uiowa.edu domain, or any subdomains.  This added safeguard provides an extra level of protection for any emails sent from an authorized University of Iowa email address. DMARC also improves email reputation and Inbox placement.

A DMARC policy can be used to authenticate a sender’s domain, verify that the email transmitted by a sender are legitimate, and identify and monitor all approved/verified senders and third-party vendor applications (i.e., Constant Contact or Mailchimp) used to transmit mail on UI’s behalf.  A DMARC policy also provides instructions to other email servers on how unauthenticated email should be handled by putting them in quarantine or Junk Email folder and in some cases, rejecting the email so that it is never delivered.

How will DMARC implementation affect you?

Most email users will notice no change in service.

If you are a department or staff member who uses a third-party email platform like Mailchimp, Constant Contact, or Salesforce Marketing Cloud, ITS staff will start to engage with you about this project. If you know you will be impacted, you can request a meeting by filling out the DMARC form for DMARC setup and validation.

Benefits of DMARC

• Reputation: Publishing a DMARC record protects your brand by preventing unauthenticated parties from sending mail from your domain. In some cases, simply publishing a DMARC record can result in a positive reputation bump.
• Inbox Placement:  DMARC improves inbox placement and keeps messages from being flagged as junk email or being blocked entirely.  Some government agencies, other organizations, and other mail systems (Gmail, Yahoo, etc.) are moving towards requiring email coming into their systems to be authenticated.
• Visibility: DMARC reports increase visibility into your email program by letting you know who is sending email from your domain.
• Security: DMARC helps the email community establish a consistent policy for dealing with messages that fail to authenticate. This helps the email ecosystem become more secure and more trustworthy.