Glossary
DMARC
Also called: Domain-based Message Authentication, Reporting and Conformance
In one sentence
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks — and sends you reports about it.
SPF and DKIM let receiving servers check whether a message is genuine, but on their own they don't say what to do with a fake. DMARC fills that gap. It also requires “alignment”: the domain that passed SPF or DKIM must match the From address people actually see, which closes the loophole spoofers use.
A DMARC record sets one of three policies. p=none means monitor only — deliver everything, but send me reports. p=quarantine means send failing mail to spam. p=reject means refuse it outright. The reports (sent to an address you specify) show every service sending mail as your domain, which is how you find the billing system or copier nobody remembered before tightening the policy.
The usual path is to start at p=none, use the reports to fix SPF and DKIM for every legitimate sender, then move to quarantine and finally reject. Staying at p=none forever is common — and it means anyone can still send email pretending to be you.
Why it matters: DMARC at enforcement is one of the most effective defenses against criminals spoofing your domain to trick your patients, clients and vendors — a classic opening for business email compromise. Google and Yahoo now require a DMARC record from bulk senders, and many cyber insurance applications ask about it.
Example: a dental practice discovers through DMARC reports that someone overseas is sending fake “pay your balance” emails using its domain. After confirming its own systems pass, the practice moves to p=reject, and those fakes stop reaching patients' inboxes.
Check your current DMARC policy with our email security checker.
Related terms
- SPF (Sender Policy Framework)SPF is a public DNS record that lists which mail servers are allowed to send email for your domain, so receiving servers can spot forged senders.
- DKIM (DomainKeys Identified Mail)DKIM adds a digital signature to every email you send, so receiving servers can confirm it really came from your domain and wasn't altered on the way.
- Business email compromise (BEC)Business email compromise is a fraud where criminals impersonate or take over a real business email account to trick staff, clients or vendors into sending money or sensitive information.
- PhishingPhishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
- Cyber insuranceInsurance that helps pay for the costs of a cyberattack or data breach — investigation, recovery, notification, legal costs and sometimes lost income.