DMARC is an email authentication policy that tells receivers what to do with mail that fails SPF and DKIM checks for your domain, and sends you reports.
Domain-based Message Authentication, Reporting and Conformance (DMARC), published as RFC 7489, builds on SPF and DKIM. It ties their results to the domain in the visible From address, lets the domain owner set a policy for messages that fail, and sends reports about who is sending mail with the domain. It is the main control against exact-domain email spoofing.
How it works
DMARC is a TXT record at _dmarc.example.com, for example v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com. A message passes when SPF or DKIM passes and the domain it checked aligns with the From domain. Relaxed alignment accepts the same organizational domain, including subdomains; strict alignment requires an exact match. The policy tells receivers what to do with failures:
p=none: monitor only.p=quarantine: treat as suspicious, usually the spam folder.p=reject: refuse the message.
Aggregate reports (rua) show which sources send as your domain and whether they pass. Gmail, Yahoo and Microsoft's Outlook.com now require bulk senders to publish DMARC alongside SPF and DKIM, so many domains have a record, but a policy of p=none does not stop spoofing.
Example
An illustrative case: a fictional company publishes p=none and learns from its reports that its HR platform sends unsigned mail and that unknown servers are sending invoices with its domain. After fixing the HR platform's DKIM, it moves to p=quarantine and then p=reject. The forged invoices are now refused by receivers that apply DMARC.
How to spot problems
- There is no
_dmarcrecord, orp=nonehas been left in place for a long time. - Reports show unknown sources sending as your domain.
- Subdomains are not covered by the policy (see the
sp=tag). - Legitimate mail fails because of alignment, not authentication.
What brands can do
- Publish DMARC with reporting, fix legitimate sources, then move to enforcement.
- Cover parked domains and subdomains with
p=reject. - Review reports regularly; new tools and vendors appear all the time.
DMARC protects your own domains, not lookalikes registered by someone else. Phishvoid monitors and takes down those lookalike domains; contact the team to discuss it. A step-by-step guide is in SPF, DKIM and DMARC against email spoofing.
Read more: SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.