Cybersecurity glossary
What is Domain-Based Message Authentication, Reporting and Conformance (DMARC)?
Learn what DMARC is, how DMARC aligns SPF and DKIM with the visible From domain, and why DMARC policy and reporting are central to reducing direct-domain email spoofing.
Definition
Domain-Based Message Authentication, Reporting and Conformance (DMARC) is an email-authentication policy layer that checks whether SPF or DKIM aligns with the visible From domain and tells receivers how to handle failing messages while providing reporting to domain owners.
Why DMARC matters
Without DMARC, a domain can publish SPF and DKIM yet still leave receivers unsure what to do when those signals do not align with the visible From domain. DMARC closes that gap by connecting authentication to the brand identity users actually see. That is why DMARC is the centerpiece of direct-domain anti-spoofing. It turns underlying email-authentication signals into a brand policy, and it gives operators reporting data they can use to clean up sender sprawl before moving to enforcement.
What a DMARC record controls
Alignment check
DMARC asks whether SPF or DKIM authenticated a domain aligned with the human-visible From address.
Receiver policy
The record tells recipients whether to monitor, quarantine, or reject messages that fail alignment.
Reporting channel
Aggregate reporting helps domain owners understand who is sending with their brand and where failures occur.
Subdomain handling
DMARC policy can also influence how unauthenticated mail from subdomains should be treated.
How DMARC is applied
A message reaches the receiver
The inbound system processes the message and collects underlying authentication results such as SPF and DKIM.
The visible From domain is identified
DMARC focuses on the From header because that is the sender identity recipients actually interpret.
SPF and DKIM alignment is evaluated
The receiver checks whether either mechanism authenticated a domain aligned with that visible From domain.
The DMARC DNS policy is read
The `_dmarc` TXT record tells the receiver which policy to apply and where to send reports.
Local handling follows policy
Depending on the record and receiver behavior, the message may be monitored, quarantined, or rejected.
Reports help the owner tune enforcement
The domain owner uses the reporting data to fix valid senders and tighten policy over time.
DMARC settings teams most often discuss
The vocabulary of DMARC is policy-oriented because its job is to convert mail-auth signals into operational decisions.
| Element | What it means | Why it matters |
|---|---|---|
| Policy mode | Values such as `none`, `quarantine`, and `reject` indicate how failing mail should be treated. | The progression from visibility to enforcement is usually how organizations roll out DMARC safely. |
| Alignment style | Relaxed or strict alignment determines how closely the authenticated domain must match the visible From domain. | This shapes how forgiving or precise your anti-spoofing policy will be across brands and subdomains. |
| Reporting addresses | Aggregate report destinations show where receivers should send summarized authentication outcomes. | Reports are often the only reliable inventory source for shadow senders using your domains. |
| Percentage and subdomain policy | Optional controls can phase enforcement or apply a distinct policy to subdomains. | These settings matter when a large organization wants to tighten protection without destabilizing all mail at once. |
DMARC rollout habits that reduce pain
Most DMARC failures come from unknown senders and messy ownership, not from the DNS syntax itself.
- Start with `p=none` and read aggregate reports long enough to discover every legitimate sender using your domains.
- Fix [SPF](/glossary/sender-policy-framework-spf) and [DKIM](/glossary/domainkeys-identified-mail-dkim) alignment before moving toward quarantine or reject.
- Separate policy decisions for apex domains, subdomains, parked domains, and marketing domains instead of forcing one posture everywhere immediately.
- Give report-processing ownership to a real team so incoming DMARC telemetry leads to action rather than just accumulation.
- Move gradually to stronger policy, but do not stop permanently at `none` if your goal is actual anti-spoofing protection.
- Use strict internal change control for mail vendors, ticketing tools, and acquisition domains because each one can quietly break alignment.
- Pair enforcement with brand monitoring because DMARC does not stop lookalike domains, [homograph attacks](/glossary/homograph-attack), or compromised legitimate accounts.
- Treat [BIMI](/glossary/brand-indicators-for-message-identification-bimi) as an optional benefit that comes after good DMARC, not as a reason to postpone mail hygiene.
DMARC protects brands, not every phishing scenario
DMARC is exceptionally good at reducing direct-domain spoofing, which is the case where an attacker wants to send mail that appears to come from your exact domain. It is much less effective against a lookalike domain that has its own perfectly valid SPF, DKIM, and DMARC setup. That is why DMARC should be read as a brand-authentication and policy control, not as a universal phishing cure. It solves a very important problem, but not the entire mail-fraud problem.
The practical takeaway
DMARC is the policy layer that aligns SPF and DKIM with the visible From domain and tells receivers how to handle failures. The practical takeaway is to use DMARC as both inventory and enforcement: publish it, read the reports, fix alignment, and move to policy levels that materially reduce direct-domain spoofing of your brand.
Related security terms
Sender Policy Framework (SPF)
SPF provides one of the underlying authentication signals that DMARC can align to the visible From domain.
DomainKeys Identified Mail (DKIM)
DKIM provides the second major authentication signal that DMARC can align and enforce.
Email Spoofing
DMARC is the core DNS policy layer for reducing direct-domain spoofing of the visible From identity.
Brand Indicators for Message Identification (BIMI)
BIMI typically depends on a strong DMARC enforcement posture before mailbox providers will show brand logos.
TXT Record
DMARC policies are commonly published as TXT records at the `_dmarc` DNS label.
Frequently asked questions
What is DMARC in simple terms?
DMARC tells receivers whether mail that fails aligned SPF and DKIM checks should be monitored, quarantined, or rejected.
Why is DMARC important if SPF and DKIM already exist?
Because DMARC connects those technical checks to the visible From domain users recognize and provides a receiver-handling policy.
What are the main DMARC policy modes?
The common progression is `p=none`, then `quarantine`, then `reject` as legitimate senders are brought into alignment.
What is DMARC alignment?
Alignment means the authenticated SPF or DKIM domain matches, or suitably relates to, the visible From domain that users see.
What do DMARC reports do?
Aggregate reports help domain owners see who is sending as their brand and where authentication is failing or misconfigured.
Does DMARC stop all phishing?
No. It mainly reduces direct-domain spoofing. Attackers can still use lookalike domains, compromised accounts, or display-name tricks.
References
Explore authoritative guidance and frameworks related to domain-based message authentication, reporting and conformance (dmarc).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.