What is DMARC? A plain-language explanation

Email lets anyone write any address in the From line. Nothing in the original design checks it. That is why a message can claim to come from your domain when it came from a stranger.

DMARC (Domain-based Message Authentication, Reporting and Conformance) lets a domain owner publish a rule: here is how to check whether mail claiming to be from me is genuine, and here is what to do when it is not.

When a message arrives, the receiving server reads the domain in the visible From address and looks up a TXT record at _dmarc.that-domain. If it finds one, it runs two checks, SPF and DKIM, and asks whether at least one passed and aligned with the From domain.

If neither passes and aligns, the message fails DMARC, and the receiver follows the policy in the record: p=none (deliver as normal and report), p=quarantine (treat as suspicious, usually spam) or p=reject (refuse it).

SPF lists which servers may send mail for your domain. DKIM adds a cryptographic signature that proves a message was not altered and that the signing domain approved it. DMARC ties them to the From address people actually see, and adds the policy and the reporting.

Reporting is the part people overlook. Mailbox providers send you daily aggregate reports, which show every server sending as your domain. That is how you find the services you forgot about before you start blocking anything.

It protects your exact domain from being forged. It does not stop look-alike domains, compromised mailboxes, or phishing that never uses your name. It is one control, not a complete answer.

Publish a record at p=none with a reporting address, read the reports for a few weeks, fix every legitimate sender that fails, then tighten the policy in steps. Our guide to moving from p=none to p=reject covers the order.