4 min read
What DMARC does and does not do
DMARC stops mail that forges your exact domain. It does not stop every kind of phishing. Here is where the line is.
What DMARC is
DMARC is a DNS record that tells receiving mail servers what to do with a message that claims to be from your domain but cannot prove it. A message passes DMARC when SPF or DKIM passes and the domain it authenticated matches the domain in the visible From address. That match is called alignment.
The record also tells receivers where to send reports, which is how you learn who is sending as you.
What it stops
At a policy of p=reject, receivers that honor DMARC refuse messages that fail it. That protects people from mail that forges your exact domain, for example an invoice that appears to come from billing@yourcompany.com but was sent by someone else.
It also gives you a complete view of the services that send as you, which is useful whether or not you ever reach enforcement.
What it does not stop
Lookalike domains. A message from yourcompany-billing.com or yourcornpany.com is from a different domain, and it can pass its own DMARC checks.
Mail from a compromised mailbox. If someone logs in as you, the mail is authentic and DMARC passes.
Phishing that does not use your domain at all. DMARC protects your domain, not your employees from every message they receive.
Receivers that do not honor DMARC. Most large mailbox providers do, but it is a request, not a guarantee.
So why do it
Because forged mail from your own domain is the most convincing kind to your customers, and DMARC is the standard way to shut it down. Large mailbox providers also expect bulk senders to publish a DMARC record. Treat it as one control among several, alongside multi-factor sign-in, domain monitoring and staff awareness.