Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is DMARC?

Definition

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS record that tells receiving mail servers how to treat email that claims to come from your domain but fails authentication, and asks them to send you reports. It is the control that makes spoofing your exact domain harder.

How It Works

DMARC builds on two older checks. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature to each message. A message passes DMARC when it passes SPF or DKIM and the domain that passed matches (aligns with) the domain in the visible From: address.

You publish a TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com. The p= tag is your requested policy:

  • none: monitor only; failing mail is still delivered.
  • quarantine: treat failing mail as suspicious (usually the spam folder).
  • reject: ask receivers to refuse failing mail.

The rua address receives aggregate reports showing every source sending as your domain. DMARC became an IETF Standards Track protocol in May 2026 as RFC 9989, which obsoletes the original RFC 7489; existing v=DMARC1 records keep working. RFC 9989 also says a domain that publishes p=reject must not rely on SPF alone and must apply valid DKIM signatures to its messages.

Real-World Example

In May 2024, the FBI, the State Department, and the NSA issued a joint advisory on North Korean Kimsuky actors who exploited weak DMARC policies to make spearphishing emails look like they came from real journalists, academics, and think tanks. The advisory shows a sample header in which the message failed DMARC (dmarc=fail (p=none ...)) for the spoofed think tank domain, but because the policy was p=none, no filtering action was taken and the email reached the victim's inbox. The agencies recommended p=quarantine or p=reject, plus rua reporting.

Why It Matters for a Small Business

Spoofed email from your own domain is how criminals pose as you to customers and vendors. Since February 1, 2024, Google has required senders of more than 5,000 messages a day to Gmail accounts to publish DMARC, and recommends SPF, DKIM, and DMARC for every domain, warning that unauthenticated mail might be marked as spam or rejected. CISA's Binding Operational Directive 18-01 required federal agencies to reach p=reject within one year. Without DMARC, both your real invoices and a fake one can look the same to the recipient.

How to Spot It / How DTS Handles It

Check your domain: no _dmarc record, or one parked at p=none, leaves spoofing unchecked. In headers, look for dmarc=fail.

DTS position: our default recommendation is to go straight to p=quarantine or p=reject, not to park at p=none. First we inventory every service that sends as your domain and make sure each signs with DKIM and aligns, then we read the aggregate reports for anything missed. See our Microsoft 365 email security service.

Mailing-list note: RFC 9989 cautions that domains whose users post to Internet mailing lists should not publish p=reject without first spending about a month each at p=none and p=quarantine. If your staff use mailing lists, we start at quarantine.

Related Terms

  • SPF: the list of servers allowed to send as your domain.
  • DKIM: the signature DMARC checks for alignment.
  • Email spoofing: the forged-sender problem DMARC addresses.
  • Phishing: spoofed sender domains make phishing more convincing.
  • Business email compromise: DMARC blocks one disguise, but not a compromised real mailbox.
  • BIMI: brand logos in the inbox, which require an enforced DMARC policy.

Sources

  • IETF, RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (May 2026, obsoletes RFC 7489): https://www.rfc-editor.org/rfc/rfc9989
  • FBI, U.S. Department of State, and NSA, North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts (May 2, 2024): https://www.ic3.gov/CSA/2024/240502.pdf
  • Google Workspace Admin Help, Email sender guidelines: https://support.google.com/a/answer/81126
  • CISA, Binding Operational Directive 18-01: Enhance Email and Web Security: https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security

Last updated October 14, 2026.