DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It builds on SPF and DKIM by asking whether an authenticated domain aligns with the domain a recipient actually sees in the From address.
It also lets a domain owner publish instructions describing how receivers should treat messages that fail DMARC and where aggregate authentication reports can be sent.
When a receiving mail system evaluates DMARC, it considers the results of SPF and DKIM and then checks alignment. SPF alignment compares the relevant SPF-authenticated domain with the visible From domain. DKIM alignment compares the signing domain in the DKIM signature with that visible From domain.
DMARC can pass through aligned SPF OR aligned DKIM. It does not require both to succeed.
A DMARC record can publish p=none, p=quarantine or p=reject. A p=none policy is generally used for monitoring and reporting while the owner learns which systems legitimately send mail. Quarantine and reject are enforcement policies that ask receivers to take stronger action on DMARC failures.
Moving toward enforcement should be staged. Domains that send through marketing platforms, CRM tools, ticketing systems and other third parties should verify authorised senders and alignment before tightening policy.
DMARC aggregate reports can show which sources are sending mail that claims to be from your domain and how those messages authenticate. They are useful for finding forgotten services, configuration gaps and unauthorised sources.
The reports are operational data rather than a security guarantee. They need to be interpreted alongside the organisation's actual sending inventory.
DMARC does not encrypt email, scan attachments, stop compromised mailboxes or prevent attackers from registering similar-looking domains. Its focus is domain authentication and policy for messages claiming to use your domain.
Use the matching ScoutLab checker with only a domain name. No signup or email address is required.
ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.
Run the free website security checkDMARC is used to connect SPF and DKIM authentication to the visible From domain, publish handling policy for authentication failures, and provide reporting that helps domain owners understand who is sending mail using their domain.
Yes. A message can still pass DMARC when DKIM passes and the DKIM signing domain aligns with the visible From domain. The reverse is also true: aligned SPF can satisfy DMARC even when DKIM does not.
No. A valid p=none record means DMARC is published and can provide authentication evaluation and reporting, but it does not request quarantine or rejection of failing messages. It is commonly a monitoring stage before enforcement.
SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.
