What is DMARC? Definition and why it matters

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS-published policy that tells receiving mail servers what to do with messages claiming to be from your domain but failing SPF or DKIM alignment: deliver, quarantine or reject, and report back to you. It is the enforcement layer on top of SPF and DKIM, and the only one of the three that actually stops exact-domain spoofing.

Key facts

Without DMARC at enforcement, anyone can send mail as your exact domain and many receivers will deliver it.
DMARC requires alignment: SPF or DKIM must pass for the same domain the recipient sees in the From header.
The reports (RUA) show every source sending as your domain, legitimate and hostile, which is how you find forgotten services before enforcing.
Major mailbox providers increasingly require DMARC from bulk senders, making it table stakes for deliverability, not just security.

The three records, briefly

SPF lists allowed sending servers: v=spf1 include:_spf.google.com -all (Google Workspace) or v=spf1 include:spf.protection.outlook.com -all (Microsoft 365). DKIM cryptographically signs mail; enable it in Google Admin or Microsoft Defender and publish the key in DNS. DMARC sets the policy:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Safe rollout to p=reject

Publish at p=none with RUA reporting: nothing changes for delivery, but you start seeing every source sending as your domain.
Review reports for 2 to 4 weeks: CRMs, invoicing tools, newsletters and ticket systems often send as your domain without alignment. Fix each (correct SPF includes, enable DKIM per service).
Move to p=quarantine, optionally with pct= staging, monitor complaints.
Finish at p=reject. Stopping at p=none, which a large share of organizations do, gives monitoring and zero protection.

What DMARC does not do

DMARC stops exact-domain forgery toward receivers that enforce it. It does not stop lookalike domains (yourc0mpany.com), display name tricks, or fraud from genuinely compromised accounts, which is where most modern impersonation lives, including phishing and BEC. Treat DMARC as necessary hygiene, and behavioral detection as the layer for everything DMARC cannot see; Sentaro verifies authentication results and covers the lookalike, display-name and compromised-account attacks beyond them.

Questions we get asked.

What does DMARC stand for?

Domain-based Message Authentication, Reporting and Conformance: a DNS policy telling receivers how to treat mail that fails SPF/DKIM alignment for your domain, with reporting back to the domain owner.

What is the difference between SPF, DKIM and DMARC?

SPF authorizes sending servers, DKIM signs messages cryptographically, and DMARC enforces alignment between those checks and the visible From domain, plus tells receivers what to do on failure.

What does p=none mean?

Monitor-only: failures are reported to you but still delivered. It is the correct starting point and the wrong place to stop.

Does DMARC stop phishing?

It stops attackers from sending as your exact domain. Phishing from lookalike domains, display names or compromised accounts is unaffected, which is why DMARC alone is not an anti-phishing strategy.

How long does DMARC rollout take?

Typically 4 to 8 weeks from p=none to p=reject for a small or mid-sized organization, driven mostly by how many third-party services send as your domain and how fast each gets aligned.