DMARC

An email security standard that tells receiving mail servers what to do with messages that fail SPF or DKIM checks for your domain, and sends you reports about them.

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, builds on SPF and DKIM. You publish a DMARC policy in your DNS that says whether failing messages should be delivered anyway (p=none), sent to spam (p=quarantine) or rejected outright (p=reject). Receiving servers also send reports showing who is sending email using your domain.

Without DMARC enforcement, criminals can often send emails that appear to come directly from your company's address. That makes invoice fraud and phishing aimed at your clients far more convincing. DMARC reports are also useful for discovering legitimate services, such as a marketing platform or billing system, that are sending email for you without proper setup.

Practical tip: start with a monitoring policy (p=none) and review the reports, or have your IT provider do it. Once all legitimate senders are correctly configured, move gradually to quarantine and then reject. Many domains publish a DMARC record but never progress past monitoring, which leaves them only partly protected.