The pillar
What is DMARC, in plain English?
DMARC is the standard that lets you tell the world's mail servers what to do with email that forges your domain. Set it up properly and you can have that mail refused before it reaches anyone.
The problem: anyone can put your name in the From line
Ordinary email was designed in a more trusting era. The From address you see
in your inbox is just a label the sender fills in. Nothing in plain email stops a stranger from
typing accounts@yourbusiness.com into that field and sending a message that looks
exactly like it came from you. This is called spoofing, and it is how a lot
of invoice fraud and phishing works.
DMARC exists to close that gap. It stands for Domain-based Message Authentication, Reporting and Conformance, but the name matters less than what it does: it gives receiving mail servers a rule for handling mail that fails to prove it is really from you, and it sends you reports on who is sending as your domain.
The two checks underneath: SPF and DKIM
DMARC does not work alone. It builds on two older records you publish in DNS, the internet's address book for your domain.
- SPF (Sender Policy Framework) is a list of the mail servers allowed to send email for your domain. A receiver checks whether the server that actually delivered the message is on your list.
- DKIM (DomainKeys Identified Mail) adds a tamper-proof signature to each message, made with a private key only you hold. The receiver checks the signature against a public key you publish, which proves the message really came from your domain and was not altered in transit.
A message passes DMARC when SPF or DKIM passes and is aligned. That last word is where most confusion lives.
Alignment: the part people get wrong
SPF and DKIM each check a domain, but not necessarily the one your reader sees. A marketing platform might send on your behalf and pass SPF for its own domain, while your customer sees your brand in the From line. DMARC only counts a pass when the domain that passed SPF or DKIM matches the visible From domain. That match is called alignment.
In short: SPF or DKIM passing is not enough on its own. The checked domain has to line up with the domain your reader actually sees. We cover this in more depth in what DMARC alignment really means.
How a DMARC policy blocks impersonation
Your DMARC record carries a policy, written as a p= tag, that tells receivers what
to do when a message claiming to be you fails these checks:
-
p=none: do nothing different, just send reports. This is monitoring only. -
p=quarantine: treat failing mail as suspicious, usually sending it to spam. p=reject: refuse failing mail outright, so it never reaches the inbox.
Only quarantine and reject actually change what happens to forged mail.
A domain sitting at p=none is watching the problem, not stopping it. The goal is
to reach p=reject safely, which is the whole point of
the path to p=reject.
Claims to be from you@yourdomain.com
Was it sent by a server your domain authorizes?
Does the signature match your domain's key?
Does the domain that passed match the visible From: address?
Delivered as genuine mail.
Your policy decides: none delivers anyway, quarantine sends to spam,
reject refuses it.
p=none it reports, but changes nothing about delivery.
What DMARC does not do
DMARC protects the domain in the visible From address. It does not stop lookalike domains (a
scammer registering yourbusiness-invoices.com), and its effect depends on the
receiving provider honoring your policy. Most large providers do. It also needs your own
mail to be authenticated properly first, or you risk your genuine messages being caught by
your own policy. That is why you always start by measuring before you enforce.
Where to go next
If you want to see your current setup, run the free DMARC checker. If you are ready to understand the rollout, read the path to p=reject. And if the reports already look like more work than you have time for, that is exactly why a DMARC service exists.