Stopping domain impersonation with DMARC Management

Brand impersonation through email is one of the most effective ways attackers exploit customer trust. A convincing spoofed message that mirrors your brand can push recipients toward fraud or identity theft — and do lasting damage to your reputation. Cloudflare's Security Center, which launched in late 2021 as a unified view of application security risks, now extends into email security with DMARC Management, currently in Beta.

DMARC Management gives you a clear picture of every service sending email from your domain. You can approve legitimate senders with one click, then set your DMARC policy to reject anything coming from unapproved sources. If a survey platform your company uses is sending mail from your domain, that's expected. If an unknown mail service from a remote country is doing so, that's a problem you can spot and fix quickly.

The three pillars of email authentication

Three mechanisms work together to keep unauthorized parties from sending mail on behalf of domains they don't own:

  • SPF lists the IP addresses of servers authorized to send email from your domain, similar to a public employee directory.
  • DKIM uses public key cryptography to sign outgoing mail. A DKIM record stores the public key; the sender keeps the private key secret and signs each email's header with it. Receiving servers use the public key to verify the signature and confirm the message wasn't altered in transit.
  • DMARC tells receiving servers what to do after evaluating SPF and DKIM results — quarantine, reject, or deliver messages that fail.

Configuration is where things get tricky. Too strict, and legitimate mail gets dropped or flagged as spam. Too relaxed, and your domain remains open to spoofing. These standards have existed for over a decade, yet fewer than 6 million active DMARC records exist today — a sign that maintenance burden is a real hurdle. DMARC reports help, and a managed solution reduces the overhead of keeping a correct configuration.

Making sense of DMARC reports

DMARC-compliant mailbox providers aggregate reports to an email address you designate. These reports list the services sending from your domain and show what percentage of messages passed DMARC, SPF, and DKIM — essential data for deciding how to adjust policy. But the raw reports arrive as a constant stream of XML, not something a human should monitor directly. That's where DMARC Management comes in.

DMARC Management automatically provisions an email address for report delivery and adds the corresponding RUA record to your Cloudflare DNS, announcing to mailbox providers where to send reports. The emails are handled with Cloudflare Email Routing, then processed by a Worker that extracts and parses the data into Cloudflare's analytics platform via Email Workers. Note that Cloudflare DNS is a requirement for the service today. Reports do not contain personal identifiable information (PII), and it may take up to 24 hours for mailbox providers to start sending them.

Reviewing senders and taking action

The DMARC Management dashboard opens with an at-a-glance view of your outbound security configuration — DMARC, DKIM, and SPF status. Below that is email volume over time, with separate lines for messages passing and failing DMARC. A detailed breakdown shows each sending source, message counts, and per-source DMARC, SPF, and DKIM statistics. Clicking any source drills into the same statistics per individual IP address, making it easy to spot IPs that need to be added to your SPF record.

Failed sources need your attention. Legitimate ones get approved — which technically means adding them to your SPF record — while the rest should be left unapproved so receiving servers reject them once your DMARC policy is set to p=reject. Getting to that strict policy is the goal, but only after you're confident every legitimate sender is accounted for. That confidence may take a few weeks depending on how many services send mail from your domain; DMARC Management helps you recognize when you're ready.

Ongoing maintenance

Once you've approved all authorized senders and configured DMARC to quarantine or reject, keeping the list current is light work — a few minutes a month. Ideally, new applications that send email from your domain get their IPs added to SPF proactively. But when that doesn't happen, new unapproved senders appear in Security Center under the Security Insights tab alongside other issues, or in the unapproved list right in DMARC Management. When a legitimate source shows up there, one click marks it approved.

What's next

DMARC Management is the first step in expanding Security Center into broader security visibility. Upcoming work connects Cloudflare's Cloud Access Security Broker (CASB) findings into Security Center. That integration will show the status of your SaaS security at a glance — CASB findings by severity, integration health, and hidden issues — so IT and security administrators can monitor their wider security surface from a single source. The DMARC Management beta waitlist is open now.