DMARC in plain language
DMARC is an email authentication policy for a domain. It works with SPF and DKIM to help receiving mail systems decide whether a message that claims to be from your domain should be trusted, quarantined, or rejected.
Why domain owners should care
If your domain can be spoofed easily, attackers can send messages that look like they came from your business. Even small sites can be abused this way. A DMARC record gives mailbox providers clearer instructions and gives domain owners reports they can use to improve setup.
What to review
- Whether SPF exists and includes the systems that send mail for you.
- Whether DKIM is enabled for your email platform.
- The DMARC policy value: none, quarantine, or reject.
- Where aggregate reports are sent.
Common mistakes
Moving straight to reject without checking legitimate senders can block real email. Start by observing, fix sending sources, then move the policy carefully.
FAQ
Does DMARC stop all phishing?
No. It helps with spoofing of your exact domain. Attackers can still use lookalike domains.
Can I check a DMARC record online?
Yes. A checker can read the DNS record and explain the visible policy.