Resources / Sender Security
What is DMARC, and why should I care?
DMARC makes sure that a message is consistent with itself: that the domain a person reads in the From address is a domain the message can prove it came from. It is enforced by the receiver, not by your mail server, and it lets the receiver make a decision about mail that seems to come from you and does not.
What SPF and DKIM leave open
Every message carries the From address that a person reads. SPF and DKIM were built to check other things.
- SPF checks the envelope sender, the hidden address bounces go to. It does not stop somebody writing your domain in the From address and using their own domain for the envelope.
- DKIM checks a signature made by whichever domain signed. It does not stop somebody signing with their own domain and writing yours in the From address.
So an attacker can use their own infrastructure, pass SPF and pass DKIM, and put your domain on the message. It looks as if it passes, and as if it belongs to you. DMARC closes the gap with one rule, alignment: SPF or DKIM has to pass for the domain in the From address.
What the reports give you
The record also asks receivers to tell you what they see. That is worth having on its own:
- You see who sends as you. Each receiver reports the IP addresses sending mail with your domain, and whether that mail passed SPF and DKIM. This is how you learn whether you are ready for a stricter policy.
- You see what changed. When your domain suddenly appears with a new sender, because somebody switched payroll providers or tried a newsletter platform, you can get it set up before it causes trouble.
- You can track deliverability by platform, and see whether you meet what large receivers ask of bulk senders.
Common misreadings
| What people say | What is true |
|---|---|
| "DMARC does not stop spoofing." | It stops mail that puts your exact domain in the From address and cannot prove it, at receivers that honor a policy of reject. It does not stop a domain that only looks like yours. That is a different attack. |
| "p=none is the same as having no record." | Not to a receiver. A record is a signal that the domain is managed, and it is what brings reports. Some large receivers now ask for one. It stops no forgery, so it is a place to start and not to stay. |
| "The security is in DKIM. DMARC adds nothing." | DKIM proves that some domain signed the message. It does not say that domain is the one the reader sees. DMARC is what ties the two together. |
| "Set it once and forget it." | A new payroll provider, a new newsletter tool or a rotated key can start failing at any time. At reject, that mail bounces. The reports show it first. |
| "Gmail requires DMARC of every sender." | Gmail and Yahoo ask for it of bulk senders. Every sender needs SPF or DKIM. Microsoft has its own rule for high-volume senders, and senders now report refusals at low volume too. |
Where to go next
DMARC policy: none, quarantine and reject covers the record itself and how to reach reject without losing mail. To see where your domain stands, check it now.
Monitor the most recent 30 days of mail for deliverability for free.