What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication policy that builds on SPF and DKIM. It tells receiving servers what to do with mail that fails authentication — monitor, quarantine, or reject — and sends you reports on who's sending as your domain.
How DMARC works
You publish a DMARC record in DNS that sets a policy: none (monitor only), quarantine (send to spam), or reject (refuse delivery). When a message fails both SPF and DKIM alignment, the receiver applies your policy.
DMARC also requires 'alignment' — the domain in the visible From address must match the domain authenticated by SPF or DKIM. This closes a loophole that lets spoofers pass authentication while still impersonating your brand in the From line.
Why DMARC matters
DMARC is what makes SPF and DKIM enforceable. Without it, a failing message might still be delivered. With a reject policy, you actively stop spoofed mail that impersonates your domain from reaching inboxes.
Major mailbox providers increasingly require DMARC for bulk senders. A correct DMARC policy both protects your brand from phishing and improves how providers treat your legitimate mail.
Rolling out DMARC safely
The standard approach is to start at p=none to collect reports without affecting delivery, confirm all your legitimate sources pass SPF and DKIM with alignment, then tighten to quarantine and finally reject.
DMARC reports reveal every service sending as your domain, which is invaluable for finding both forgotten legitimate senders and outright spoofing. Combined with verification of your recipient lists, it rounds out a trustworthy sending program.
In practice
An attacker tries to send phishing mail from your exact domain. Because you publish a DMARC reject policy and the spoofed message fails SPF and DKIM alignment, receiving servers refuse it outright — protecting your customers and your domain's reputation.
Frequently asked questions
Verify emails with confidence
Mailbeam handles all of this for you — syntax, MX, SMTP, catch-all, and disposable checks in one API call. 1,000 free verifications/month, no credit card.