Every day, billions of emails are sent, and a surprising number of them are fake. Cybercriminals craft messages that appear to come from your bank, your boss, or your favorite online store, hoping you’ll click a malicious link or wire money to the wrong account. To fight this, security experts developed a set of tools, and one of the most important is DMARC. But DMARC is not a magic bullet. It has a specific job, and it does it well, but it can’t do everything. Understanding exactly what DMARC protects you from—and what it doesn’t—is crucial for anyone who manages a domain or relies on email for business.
The Email Authentication Stack: SPF, DKIM, and DMARC
Before we dive into DMARC, it helps to understand the problem it solves. Email was designed in the 1970s, when the internet was a friendly place and nobody imagined that someone would want to forge an email address. As a result, the protocol has no built-in way to verify that the sender is who they claim to be. That’s why we need extra layers of authentication.
SPF (Sender Policy Framework) is like a guest list at a party. It lists the IP addresses that are allowed to send email for your domain. When a message arrives, the receiving server checks the envelope sender (the technical return address) against the list. If the IP isn’t on the list, the message can be rejected. But SPF has a weakness: it checks the envelope, not the visible ‘From’ address that you see in your email client. An attacker can easily spoof the display name or use a different envelope domain to bypass SPF.
DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Think of it as a wax seal on a letter. The signature is created with a private key held by the sending domain, and the receiving server can verify it using a public key published in DNS. This proves that the message hasn’t been tampered with and that it really came from the domain that signed it. But again, there’s a catch: DKIM alone doesn’t tie the signature to the ‘From’ address you see. An attacker could sign a message with their own domain and still put your domain in the ‘From’ field.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) was introduced in 2015 to close this gap. It builds on SPF and DKIM, but adds a crucial concept called alignment. Alignment means that the domain in the ‘From’ header must match (or be aligned with) the domain used in SPF or DKIM. If it doesn’t, the message fails DMARC. DMARC also lets you tell receiving servers what to do with failed messages: send them to spam (quarantine), reject them outright, or just monitor them (none). And it provides reports so you can see who is sending email using your domain.
What DMARC Protects You From
DMARC’s primary job is to stop direct domain spoofing. That’s when an attacker sends an email that appears to come from your exact domain, like ceo@yourcompany.com. Without DMARC, a spammer can easily forge that address, and the receiving server has no way to know it’s fake. With DMARC, if the message fails SPF and DKIM alignment, the receiver will quarantine or reject it, depending on your policy.
This is a huge win against phishing and Business Email Compromise (BEC) attacks. BEC scams often involve an email that looks like it’s from a CEO or CFO, asking an employee to transfer funds or buy gift cards. By authenticating your domain, DMARC makes it much harder for attackers to impersonate your executives.
DMARC also protects your brand reputation. If your domain is known to send only authenticated mail, recipients and email providers will trust it more. This can improve deliverability for your legitimate emails, because they’re less likely to be flagged as spam.
Finally, DMARC helps you discover unauthorized use of your domain. The reports (called RUA and RUF) show you who is sending mail claiming to be from you. You might find that a rogue marketing tool or a forgotten server is sending emails without proper authentication. This gives you the chance to fix it or shut it down.
What DMARC Does NOT Protect You From
Now for the important part: DMARC is not a silver bullet. Here are the main things it can’t do.
Lookalike Domains
DMARC only works for your exact domain. If an attacker registers yourcompany-secure.com or yourcompany.co (instead of .com), DMARC has no power over that. These lookalike domains are a common tactic because they’re easy to register and can fool people who aren’t paying close attention. To protect against this, you need to monitor domain registrations and consider registering similar domains yourself.
Compromised Legitimate Accounts
If an attacker gains access to a real email account (through a phishing attack or a data breach), they can send emails that pass all authentication checks. DMARC sees a valid signature and a matching domain, so it lets the email through. This is a serious gap, and it’s why you need strong passwords, multi-factor authentication, and user training.
Malicious Content from Legitimate Senders
DMARC authenticates the domain, not the content of the message. A cybercriminal could compromise a legitimate marketing service and send malicious emails that are properly authenticated. DMARC won’t stop that. It’s not a content filter; it’s a gate that checks ID, not intent.
Subdomains Not Covered by Your Policy
By default, a DMARC policy on your root domain (like yourcompany.com) applies to that domain and all subdomains, but only if you set it up correctly. If you don’t use a wildcard (*) or explicitly list subdomains, an attacker could spoof subdomain.yourcompany.com and get away with it. Make sure your DMARC record covers all subdomains.
Attacks via Third-Party Services
Many businesses use third-party services to send email (like Mailchimp or Salesforce). If those services are compromised, an attacker could send emails that pass SPF and DKIM because the service is authorized. DMARC won’t stop that. It’s a reminder that you need to trust your vendors and monitor their security.
Malware and Ransomware Payloads
DMARC does not scan attachments or URLs. If an email passes authentication but contains a malicious link or a poisoned PDF, DMARC will let it through. You need additional security layers, like email filtering and antivirus, to catch those threats.
Why DMARC Was Created and How It’s Evolving
Before DMARC, SPF and DKIM existed but were optional and not aligned. Receivers had no standardized way to know what to do with unauthenticated mail. DMARC changed that by giving domain owners a way to set a policy and get reports.
In February 2024, major providers like Gmail and Yahoo began mandating DMARC for bulk senders (those sending more than 5,000 messages a day). They require at least a p=none policy initially, with a path to p=quarantine or p=reject. This has pushed many organizations to adopt DMARC, but small and medium domains still lag behind.
Implementing DMARC is a three-stage process:
1. Monitor (p=none): You collect reports and see who is sending as you, without affecting delivery.
2. Quarantine (p=quarantine): Failed messages go to spam.
3. Reject (p=reject): Failed messages are bounced.
It’s important to start with p=none to avoid breaking legitimate email, then gradually tighten the policy as you fix issues.
Practical Advice: Using DMARC Wisely
DMARC is a powerful tool, but it must be part of a broader security strategy. Here are some tips:
- Set up SPF and DKIM first. DMARC relies on them. Make sure they’re correctly configured for all your sending systems.
- Use a DMARC monitoring service. The XML reports are complex; a dashboard can help you interpret them.
- Start with
p=noneand review reports. You’ll likely discover shadow IT—systems sending email you didn’t know about. - Gradually move to
p=quarantineand thenp=rejectas you gain confidence. - Don’t forget subdomains. Use a wildcard or explicit subdomain policy.
- Combine DMARC with BIMI (Brand Indicators for Message Identification) to display your logo in supported email clients, which also reinforces trust.
- Remember that DMARC is not a substitute for user training. Even with DMARC, your employees need to be cautious about suspicious emails, especially those from lookalike domains or with unexpected requests.
DMARC is an essential part of email security, but it’s not a complete solution. It stops direct domain spoofing and helps protect your brand, but it can’t catch lookalike domains, compromised accounts, or malicious content. By understanding its strengths and limitations, you can use DMARC effectively as one layer in a multi-layered defense. Start with monitoring, tighten your policy gradually, and always pair DMARC with other security measures like strong authentication and employee awareness.
Summary
- DMARC is an email authentication protocol that builds on SPF and DKIM, requiring alignment with the ‘From’ domain.
- It protects against direct domain spoofing, phishing, and BEC attacks by telling receivers to quarantine or reject unauthenticated mail.
- DMARC does not protect against lookalike domains, compromised legitimate accounts, malicious content, unprotected subdomains, or attacks via third-party services.
- Implementation should start with p=none (monitor), then move to p=quarantine and p=reject as you fix issues.
- DMARC is a necessary but insufficient security layer; combine it with other defenses like MFA and user training.
FAQ
Q: What is DMARC and how does it work?
A: DMARC is an email authentication protocol that tells receiving servers what to do with emails that fail SPF and DKIM checks. It works by publishing a DNS record that specifies a policy (none, quarantine, or reject) and requires that the domain in the ‘From’ header aligns with the domain used in SPF or DKIM.
Q: Does DMARC stop all phishing attacks?
A: No. DMARC only stops direct spoofing of your exact domain. It does not stop lookalike domains, compromised accounts, or malicious content from legitimate senders. Phishing attacks that use these methods can still get through.
Q: What is the difference between SPF, DKIM, and DMARC?
A: SPF checks the envelope sender’s IP address, DKIM adds a digital signature, and DMARC ties them together by requiring alignment with the ‘From’ domain. DMARC also provides a policy for handling failed messages and reporting.
Q: How do I start implementing DMARC?
A: Begin by publishing a DMARC record with p=none to monitor your email traffic. Review the reports to identify legitimate senders and fix any authentication issues. Then gradually tighten the policy to p=quarantine and eventually p=reject.
Q: Can DMARC hurt my email deliverability?
A: Yes, if misconfigured. If you set p=reject without ensuring all your legitimate senders pass SPF and DKIM alignment, you could block your own emails. That’s why it’s important to start with p=none and test thoroughly.