DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that turns SPF and DKIM into an enforceable domain policy. The domain owner publishes a DNS record instructing receiving servers how to treat messages that fail authentication — deliver, quarantine or reject — and where to send reports about those failures. It is the layer that actually protects the From address people see in their mail client.

How DMARC works

The policy lives in a TXT record at _dmarc.example.com, for instance v=DMARC1; p=reject; rua=mailto:dmarc@example.com. A receiving server evaluates each message in three steps:

1. Authentication — run SPF (is the sending IP authorised?) and verify any DKIM signature.
2. Alignment check — DMARC's core contribution: the domain in the visible From header must match the domain that passed SPF or DKIM. Without alignment, a scammer could pass SPF on scammer.example while displaying yourbank.com to the victim.
3. Policy application — if both aligned checks fail, the receiver applies the published disposition: p=none (monitor only), p=quarantine (spam folder) or p=reject (refuse delivery). The pct tag phases enforcement in gradually and sp sets a separate policy for subdomains.

Aggregate reports (rua) arrive daily as XML files listing every source that sent mail claiming your domain, with authentication results — the only reliable inventory of both your legitimate senders and active spoofing attempts.

DMARC in practice

DMARC is the primary defence against phishing that impersonates your brand, and since 2024 Gmail and Yahoo require a published policy from bulk senders. A safe rollout is incremental: start at p=none, spend a few weeks reading reports to discover every legitimate sending service (CRM, newsletters, invoicing), authenticate each of them, then tighten to quarantine and finally reject. Parked domains that never send mail deserve DMARC too — publish p=reject so fraudsters cannot borrow their name.