DMARC Explained: Stop Spoofing & Protect Your Domain

If you've ever had a customer forward you a "phishing email" that looked like it came from your company but didn't, you've felt the pain DMARC exists to solve. Spoofing — sending mail that looks like it's from a domain it isn't — is the root cause behind phishing, business email compromise, and a surprising amount of deliverability damage.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the standard that ties together SPF and DKIM and tells receivers what to do when both fail. It's not a standalone protocol — it's the policy layer on top. And when it's set up right, it's the single most effective thing you can do to protect both your brand and your inbox placement.

What DMARC Actually Does

DMARC answers three questions for every email that claims to come from your domain:

• Did it pass SPF or DKIM? At least one must pass, and the passing domain must align with the visible From: address.
• What should the receiver do if it failed? Your DMARC policy tells them: monitor (p=none), quarantine (p=quarantine), or reject (p=reject).
• Where should reports go? DMARC sends aggregate (XML) and forensic (per-message) reports to the email address you specify.

Building Your DMARC Record

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. Here's a minimal monitoring-only record to start with:

_dmarc  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; sp=none; adkim=s; aspf=s"

Breaking that down:

• v=DMARC1 — the protocol version. Always DMARC1.
• p=none — the policy. Start with none (monitor only). Move to quarantine, then reject, as you gain confidence.
• rua=mailto:... — where aggregate reports go. These are daily XML summaries of all mail using your domain.
• ruf=mailto:... — where forensic reports go. These are per-message failure samples (may not always be sent depending on receiver).
• sp=none — the policy for subdomains. Set this explicitly so subdomains don't accidentally inherit a stricter policy.
• adkim=s / aspf=s — strict alignment. The domain in the DKIM signature or SPF check must exactly match the From: domain.

The Three-Phase Rollout

Phase 1: Monitor (p=none)

Publish p=none and collect reports for at least two weeks. This tells you every source sending mail as your domain — legitimate third parties, internal servers, and any unauthorized senders. You'll likely discover things you didn't know about: a marketing tool, a billing platform, a forgotten CRM.

Phase 2: Quarantine (p=quarantine)

Once you've identified and fixed all legitimate sources, move to p=quarantine. Failed messages go to spam rather than the inbox. Watch your reports for a few more weeks — if legitimate mail starts getting quarantined, you've missed a source. Fix it before proceeding.

Phase 3: Reject (p=reject)

Finally, move to p=reject. Failed messages are refused at the server level. This is the end state — your domain is fully protected. Keep monitoring reports monthly to catch any new sources that come online.

Reading DMARC Reports

DMARC aggregate reports are XML files sent daily by receivers like Gmail, Outlook, and Yahoo. Each report lists:

• The source IP address
• How many messages came from that IP
• Whether SPF and DKIM passed
• Whether DMARC alignment passed
• The policy you had published at the time

Raw XML isn't pleasant to read. Use a DMARC report analyzer (there are several free and paid options) to get a visual dashboard. The key thing to look for: any source IP that's failing authentication but still sending volume. That's either a misconfigured legitimate sender or a spoofing attempt.

Subdomain Considerations

By default, the sp (subdomain policy) inherits from p. If you have subdomains used by third-party tools (e.g., events.yourdomain.com for a webinar platform), make sure they have their own SPF and DKIM records. If a subdomain doesn't send mail at all, consider publishing v=DMARC1; p=reject; specifically for it to preempt any spoofing attempts.

Wrapping Up

DMARC is the capstone of email authentication. It won't fix deliverability on its own — but without it, you're leaving your domain open to spoofing and your inbox placement at the mercy of whatever a scammer decides to do with your name. Start with p=none, read your reports, fix your sources, and ramp up to p=reject. The whole process typically takes 4–8 weeks, and once it's done, it largely runs itself.

Need help setting up DMARC or interpreting your reports? Get in touch — we do this every day.