What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol (opens in new tab) that lets a domain owner publish a policy telling receiving mail servers how to handle messages that claim to come from the domain but fail SPF (opens in new tab) and DKIM (opens in new tab): deliver them, quarantine them, or reject them.
It also gives the domain owner aggregate reporting (opens in new tab) on the sources sending mail under the domain's name. DMARC protects the exact domain in the visible From: address; lookalike domains, display names, and non-email channels sit outside its scope.
How DMARC works
A domain owner publishes the DMARC policy as a DNS TXT record (opens in new tab) at the _dmarc subdomain of the protected domain, for example _dmarc.example.com. When a message arrives, the receiving server runs SPF and DKIM, then performs the check unique to DMARC: identifier alignment (opens in new tab).
The domain in the visible From: header must match a domain that SPF or DKIM actually validated. If an authenticated identifier aligns, the message passes; if none does, the receiver applies the published policy.
Alignment is the point a phishing email exploits: a message can carry a perfectly valid DKIM signature from an unrelated domain and still be a forgery of the sender a person actually reads.
A canonical DMARC record looks like this:
v=DMARC1; p=reject; adkim=s; aspf=r; rua=mailto:[email protected]
It tells receivers to reject failing mail, sets strict DKIM alignment and relaxed SPF alignment, and routes daily aggregate reports to [email protected].
The p= tag accepts exactly three values (opens in new tab):
- p=none. Monitoring mode (opens in new tab). Receivers deliver failing messages normally while the domain owner collects reports. It provides visibility, not protection.
- p=quarantine. Receivers route failing messages to spam or junk. That still leaves residual risk: a user can find the message and act on it.
- p=reject. Receivers refuse delivery of failing messages outright. This is the target state.
DMARC's current specification is RFC 9989 (opens in new tab) (DMARCbis), published in May 2026 to replace RFC 7489, with companion standards for aggregate reporting (RFC 9990) and failure reporting (opens in new tab); the update also retired the older pct sampling tag.
Why DMARC matters
DMARC is now a delivery requirement, not just a defense. Since February 1, 2024, bulk senders to Gmail have had to use SPF, DKIM, and a DMARC record at minimum p=none under Gmail's sender guidelines (opens in new tab), and bulk senders to Yahoo faced parallel requirements (opens in new tab) the same month.
Beginning May 5, 2025, high-volume senders to Outlook.com, Hotmail.com, and Live.com that fail those requirements receive an outright 550 5.7.515 access-denied (opens in new tab) rejection. Under CISA's Binding Operational Directive 18-01 (opens in new tab), U.S. federal civilian agencies must run DMARC at p=reject.
Protection begins at p=quarantine. A monitoring-only policy satisfies the mailbox providers while leaving the domain open to spoofing.
What DMARC does not protect against
DMARC combats only specific forms of exact-domain forgery, and it does not address cousin-domain abuse or misuse of the From: display name.
For brand-protection teams, that boundary defines most of the remaining threat surface:
- Lookalike domains. An attacker who registers a visually similar domain (opens in new tab) controls its DNS and can publish valid SPF, DKIM, and DMARC records of their own. Because DMARC authenticates the attacker-controlled domain rather than the impersonated brand's, every relevant check can pass.
- Display-name spoofing. An attacker can set the human-readable sender name to "CEO First Last" while sending from an unrelated authenticated address, which falls outside the domain DMARC checks.
- Compromised accounts and trusted infrastructure. Mail from a compromised vendor or employee account originates on genuinely authorized infrastructure and authenticates cleanly.
- Subdomain gaps. Dangling DNS records (opens in new tab) pointing to expired third-party services let attackers send authenticated mail from a legitimate brand's subdomain, and a weaker subdomain policy set through sp= can leave those subdomains open to spoofing.
- Non-email channels. SMS phishing, voice phishing, and social media impersonation operate entirely outside the email authentication layer.
How to implement DMARC
Deploy in stages, moving from visibility to enforcement. Start at p=none with a rua= reporting address and read the aggregate reports; participating receivers typically begin sending them (opens in new tab) soon after publication.
The reports surface the sources sending under the domain's name, including shadow IT and forgotten third-party senders. (Forensic ruf= failure reports (opens in new tab) are sent less often because they can expose message content.) Authenticate every legitimate stream before you enforce: third-party providers (opens in new tab) must sign with an aligned DKIM d= domain or pass SPF with an aligned MAIL FROM domain, or their mail breaks under enforcement.
Move to p=quarantine once all or most legitimate traffic authenticates (opens in new tab), then advance to p=reject, monitoring the reports closely for an extended period (opens in new tab) after each change. Finally, publish p=reject on parked domains (opens in new tab) and any other domain that does not send email.
How Doppel helps
DMARC stops at the exact domain in the From: address. The lookalike domains, display-name lures, and compromised accounts that route around it never fail an authentication check. Doppel is the AI-native Social Engineering Defense (SED) platform that unifies Digital Risk Protection and Human Risk Management, and it goes after that residual infrastructure directly.
Brand Protection detects and dismantles the lookalike domains, spoofed profiles, and scam ads behind mail that clears SPF, DKIM, and DMARC. The Doppel Threat Graph correlates those signals into campaign-level views of attacker infrastructure, and agentic AI drives the takedowns while analysts handle the novel cases.
Request a demo to trace an authenticated-looking email back to the campaign behind it and see how Doppel makes your brand too costly to attack.
Frequently asked questions about DMARC
What is DMARC in email security?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that lets a domain owner tell receiving mail servers how to handle messages for which neither Sender Policy Framework (SPF) nor DomainKeys Identified Mail (DKIM) produces an authenticated identifier aligned with the visible From: domain: deliver, quarantine, or reject them. A domain owner implements it through a DNS TXT record at the _dmarc subdomain of the protected domain. DMARC also provides aggregate reporting (opens in new tab), which gives domain owners visibility into the sources that participating receivers observe sending mail under their name. It prevents spoofing of the exact domain only.
What is the difference between DMARC, SPF, and DKIM?
The SPF standard (opens in new tab), or Sender Policy Framework, authorizes which servers may send mail for a domain, and the DKIM standard (opens in new tab), or DomainKeys Identified Mail, cryptographically signs messages so receivers can verify the signing domain. Domain-based Message Authentication, Reporting, and Conformance (DMARC) adds two controls on top: it requires identifier alignment between the visible From domain and the domain SPF or DKIM validated, and it publishes a policy (none, quarantine, or reject) for messages that fail. It also adds a reporting channel back to the domain owner.
Does a p=none DMARC policy protect against spoofing?
No. A p=none DMARC policy is monitoring mode: receivers report authentication failures to the domain owner but deliver the failing messages normally. It is the right starting point, because the reports reveal the legitimate and illegitimate sources that participating receivers observe sending under the domain's name. Protection begins at p=quarantine, which routes failing mail to spam, or p=reject, which refuses delivery. Under CISA's Binding Operational Directive 18-01 (opens in new tab), U.S. federal civilian agencies must reach p=reject.
What is an example of a phishing attack that bypasses DMARC?
One example is lookalike-domain phishing. Attackers register a visually similar domain, configure its SPF, DKIM, and DMARC records, and send phishing from infrastructure they control; every relevant check can pass because the attackers own the domain being authenticated. Attacks from compromised legitimate accounts also pass DMARC, since the mail genuinely originates on authorized infrastructure. Display-name spoofing and attacks delivered over SMS, voice calls, or social media fall outside DMARC's protocol scope.