---
title: "Why are sources an important aspect of ensuring email security with DMARC? | DuoCircle"
description: "Why are sources an important aspect of ensuring email security with DMARC?"
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/"
---

Quick Answer

In DMARC, sources are every system authorized to send mail using your domain: ESPs, ISPs, marketing platforms, ticketing systems, payment providers, and any other tool that touches outbound email. They matter because DMARC only passes when the From-domain aligns with an SPF or DKIM result, so any source you forget to authorize will fail authentication and either land in spam or get blocked. To manage them, build a complete inventory of sending services, add their IPs or includes to your SPF record, configure DKIM keys for each, then publish a DMARC policy and read the reports to catch unknown senders, forwarding-related failures, and misconfigured legitimate services. Authorize the legitimate ones, move the policy to quarantine or reject for the rest.

Why are sources an important aspect of ensuring email security with DMARC?

Your browser does not support the audio element.

[ Download episode](https://media.mailhop.org/duocircle/images/2024/08/Why-are-sources-an-important-aspect-of-ensuring-email-security-with-DMARC.mp3) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Why%20are%20sources%20an%20important%20aspect%20of%20ensuring%20email%20security%20with%20DMARC%3F&url=undefined%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F&title=Why%20are%20sources%20an%20important%20aspect%20of%20ensuring%20email%20security%20with%20DMARC%3F "Share on Reddit") [ ](mailto:?subject=Why%20are%20sources%20an%20important%20aspect%20of%20ensuring%20email%20security%20with%20DMARC%3F&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F "Share via Email") 

![email security](https://media.mailhop.org/duocircle/images/2024/08/spf-record-5716.jpg) 

By now, you might have heard a lot about how [DMARC reports](/content/dmarc-report) are crucial for your organization to gain insights into your email traffic and learn how your authentication protocols are waging against [phishing](https://www.channelnewsasia.com/singapore/ai-phishing-attempts-cyber-attacks-technology-scams-deepfakes-ransomware-4506631) and [spoofing attempts](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-scam-strikes-back-exploiting-the-crowdstrike-outage/). They reveal the harsh truth, that is, not all emails claiming to be from your domain are legitimate. While you’re decoding DMARC reports, have you ever looked into the **sources** of these emails?

Sources, in the context of [DMARC](/email/dmarc), are the sources and servers that are sanctioned to send emails on your behalf. _Your list of sources may include **email service providers (ESPs)**, internet service providers (ISPs), [marketing platforms](https://www.indeed.com/career-advice/career-development/what-is-a-marketing-platform), and other tools that your organization uses to communicate via email._

But why should they be a part of your [email security](/) strategy? In this article, we will look at the **importance of sources** of DMARC and how to update and maintain them.

## What are sources?

Sources refer to the various entities that are entitled to send emails on behalf of your domain. This includes **any platform/service** that is involved in email communication at any level, like the ESP, which facilitates marketing and [transactional emails](https://www.klaviyo.com/blog/transactional-email); ISP, which allows you to receive and send emails; and other services like [ticketing systems](https://www.zendesk.com/service/help-desk-software/ticketing-system/), [payment providers](https://en.wikipedia.org/wiki/Payment%5Fservice%5Fprovider), etc. 

Since these platforms are authorized from your end, they fall under the category of **trusted sources**. On the other hand, there are unauthorized or [unknown sources](https://www.chroniclelive.co.uk/news/uk-news/amazon-prime-scams-warning-fraudsters-29616231) that attempt to send emails without proper authorization. 

## What is the role of sources in DMARC?

It goes without saying that you should have a clear outlook of all the entities sending emails under the name of your organization. _As a domain owner, you should be aware of **who is sending what** and ensure that all communications are legitimate and accounted for._

This is especially true when you’re implementing DMARC for your [sending domain](https://help.edrone.me/en/articles/8731942-sending-domain-why-it-s-so-important). By identifying and managing your email sources, you can ensure that **only legitimate emails pass** through DMARC checks. This involves updating [SPF](/content/spf-record-check) (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) records to reflect all authorized sending entities.

[![email deliverability](https://media.mailhop.org/duocircle/images/2024/08/sender-policy-framework-5497.jpg)](https://media.mailhop.org/duocircle/images/2024/08/sender-policy-framework-5497.jpg)

Moreover, when your sources are correctly configured and authenticated, your emails are **less likely to be marked as spam** by recipient mail servers, thereby boosting your engagement and [email deliverability](/a-guide-on-email-deliverability).

## How do you create and update sources?

_One of the most crucial steps of updating sources in DMARC is curating a comprehensive **list of all services and platforms** that send emails on your behalf._ While we understand that making such a list is a time-consuming and tedious task, the more thorough you are with it, the better your email security will be.

Once you have the list ready with you, add the **IP addresses or domains** of these services to your [SPF record](/content/spf-records/spf-record-example). You also need to configure [DKIM](/resources/what-is-dkim) for each service and add the [public key](https://www.techtarget.com/searchsecurity/definition/public-key) to your DNS. _The important thing to understand with known sources is that they only need to be aligned with either SPF or DKIM to be considered for DMARC check._ 

After setting up SPF and DKIM, the next step is to create a [DMARC policy](/resources/dmarc-policy) for your domain and publish it in your DNS. This policy will **instruct email receivers** on how to handle emails that don’t pass the [DMARC checks](/dmarc/causes-and-solutions-of-dmarc-failures/). 

## What about unknown sources?

_For the unknown/threat sources that **appear in your DMARC report**, it’s essential to assess and address each one carefully._ While some of these sources might be illegitimate or spoofed, others could be misconfigured legitimate senders. This usually happens while [email forwarding](/email/email-forwarding), wherein the **mail server rewrites the headers and renders** your SPF record invalid. In this case, your primary goal should be to authenticate these sources to improve email deliverability.

To do so, determine whether the source is a legitimate sender that was not previously authorized or updated in your [DNS records](/data-privacy/dns-record-types-defined-and-explained/). If the source is legitimate, **update your SPF and DKIM records** to authorize it. If it seems like a threat, enhance your defenses by setting the DMARC policy to “quarantine” or “reject”.

## How DuoCircle can help you optimize your email security?

Managing sources in DMARC is not just a technical necessity but a strategic step to enhance your [domain’s security](https://www.namehero.com/blog/domain-security-5-strategies-to-protect-your-website/) and reputation. By maintaining, updating, and monitoring both known and unknown sources, you can significantly enhance your **domain’s integrity** and deliverability.

[![domain security](https://media.mailhop.org/duocircle/images/2024/08/hosted-email-server.jpg)](https://media.mailhop.org/duocircle/images/2024/08/hosted-email-server.jpg)

As important as this process is, it can also be tedious, especially given the **vastness of the email ecosystem** and the number of platforms that organizations rely on to facilitate their [business operations](https://www.wix.com/encyclopedia/definition/business-operations). 

Want to know how to effectively update and manage your sources? Our team at **DuoCircle will help you** with all things related to DMARC reporting and more! For a deeper dive into effectively managing your [DMARC setup](/dmarc/how-to-publish-a-dmarc-record/) and improving your email system’s security, [book a demo](/contact) with us today!

## Topics

DKIMDMARCemail securityUpdates 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F) [ ](https://twitter.com/intent/tweet?text=Why%20are%20sources%20an%20important%20aspect%20of%20ensuring%20email%20security%20with%20DMARC%3F&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fwhy-are-sources-crucial-for-email-security-with-dmarc%2F) Copy 

Related Articles

- [ ![DMARC problems](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg)  A guide to detecting DMARC problems using the pentesting techniques DMARC ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)
- [ ![DMARC policy](https://media.mailhop.org/duocircle/images/2024/11/spf-validator-7326.jpg)  DMARC policy explained: p=none, quarantine, reject DMARC ](/blog/dmarc/dmarc-policy-guide-for-beginners/)
- [ ![DMARC reporting](https://media.mailhop.org/duocircle/images/2024/12/hosted-email-server-0505.jpg)  How are DMARC enforcement and DMARC reporting different? DMARC ](/blog/dmarc/how-are-dmarc-enforcement-and-dmarc-reporting-different/)
- [ ![DMARC expert](https://media.mailhop.org/duocircle/images/2024/09/dmarc-report-5.jpg)  How to become a DMARC expert: a 6-step learning path DMARC ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/)

## Related Articles

[  DMARC 6m  A guide to detecting DMARC problems using the pentesting techniques  Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[  DMARC 6m  DMARC policy explained: p=none, quarantine, reject  Nov 22, 2024 ](/blog/dmarc/dmarc-policy-guide-for-beginners/)[  DMARC 6m  How are DMARC enforcement and DMARC reporting different?  Dec 5, 2024 ](/blog/dmarc/how-are-dmarc-enforcement-and-dmarc-reporting-different/)[  DMARC 6m  How to become a DMARC expert: a 6-step learning path  Sep 24, 2024 ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Why are sources an important aspect of ensuring email security with DMARC?","description":"Why are sources an important aspect of ensuring email security with DMARC?","url":"https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/","datePublished":"2024-08-01T15:29:58.000Z","dateModified":"2025-08-20T18:25:27.000Z","dateCreated":"2024-08-01T15:29:58.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, email security, Updates","wordCount":818,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/08/spf-record-5716.jpg","caption":"email security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"Why are sources an important aspect of ensuring email security with DMARC?","item":"https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Why are sources an important aspect of ensuring email security with DMARC?","item":"https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Why are sources an important aspect of ensuring email security with DMARC?","description":"Why are sources an important aspect of ensuring email security with DMARC?","url":"https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/","datePublished":"2024-08-01T15:29:58.000Z","dateModified":"2025-08-20T18:25:27.000Z","dateCreated":"2024-08-01T15:29:58.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/why-are-sources-crucial-for-email-security-with-dmarc/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, email security, Updates","wordCount":818,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/08/spf-record-5716.jpg","caption":"email security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```