DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM to give domain owners control over what happens to mail that fails authentication checks and visibility into who is sending email using their domain.

What DMARC Means in Marketing

SPF and DKIM each verify something about an email. DMARC is the policy that tells inbox providers what to do when those verifications fail, and the reporting system that tells you what is happening with your domain.

Without DMARC, even if you have SPF and DKIM configured, there is no instruction to inbox providers about how to handle mail that fails those checks. DMARC closes that gap. A DMARC policy of reject tells Gmail, Outlook and Yahoo to refuse delivery of any mail claiming to come from your domain that does not pass authentication. That stops phishing emails that impersonate your brand before they reach recipients.

The reporting component is equally valuable. DMARC reports tell you every day which mail servers are sending email using your domain. This reveals legitimate sending you had not fully authenticated (a CRM you forgot to set up, a newsletter platform a team added without telling IT) and malicious attempts to spoof your domain.

How DMARC Works

The three policy levels:

p=none is monitoring mode. Failed mail is delivered normally. DMARC reports are sent to the address you specify. Use this first to understand your sending environment before applying any enforcement.

p=quarantine routes failed mail to the spam folder. Legitimate mail that is not authenticated lands in junk. Use this as a transitional step after confirming that all your legitimate sending passes authentication.

p=reject instructs inbox providers to refuse delivery of failed mail entirely. This is the strongest protection against domain spoofing. Only move here once you are confident every legitimate source is correctly authenticated.

Alignment requirements:

DMARC requires that either the SPF-authenticated domain or the DKIM-signing domain aligns with the From header domain. This alignment requirement prevents attackers from using authenticated sending infrastructure they legitimately control to spoof your domain.

The DNS record:

DMARC is published as a DNS TXT record at _dmarc.yourdomain.com. A basic example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Reading the reports:

Aggregate reports arrive as XML files, which are difficult to read directly. Free and paid tools parse them into readable dashboards. Review them weekly when setting up and monthly once your policy is stable.

DMARC Example

A financial services brand discovers through DMARC reports that several hundred phishing emails per day are being sent from unknown servers claiming to use their domain. Because their DMARC policy is still set to none, those emails are being delivered. They complete their authentication configuration, confirm all legitimate sending passes, and move the policy to reject. The phishing emails stop reaching inboxes. Customer complaints about fake emails drop.

Why DMARC Matters for Marketers

Your email domain is your brand. If attackers can use it to send phishing emails, those emails damage your customers and your brand’s credibility. DMARC is the tool that lets you stop it. It also improves deliverability: inbox providers treat domains with DMARC enforcement as more trustworthy senders, which supports inbox placement for your legitimate campaigns.