What is DMARC and how it stops email spoofing

DMARC is the DNS policy that ties SPF and DKIM to the address your recipients actually see - and tells receivers what to do when a message fails. Set it to reject and most spoofed mail never reaches an inbox.

SPF and DKIM each prove something about an email, but neither protects the visible "From" address your recipients read. DMARC closes that gap. It connects the two and gives receivers a clear instruction: quarantine or reject anything that fails. This guide explains what a DMARC record is, how it works, where it goes wrong, and how SecRift checks yours.

What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It is a DNS TXT record, published at _dmarc.example.com, that does two jobs: it tells receiving mail servers how strictly to treat messages that fail authentication, and it asks them to send you reports about the mail flowing under your domain.

A basic record looks like this:

v=DMARC1; p=reject; rua=mailto:[email protected]

That says: if a message claiming to be from this domain fails authentication, reject it - and send aggregate reports to this mailbox.

DMARC is the layer that makes SPF and DKIM meaningful for the address humans actually see. On its own, SPF checks the hidden envelope sender. DMARC requires that a passing result also aligns with the visible "From" domain, which is what an attacker forges.

How DMARC works

When a receiver gets a message, it runs SPF and DKIM, then applies DMARC:

• Alignment. DMARC passes if SPF or DKIM passes and the authenticated domain matches the visible "From" domain. A message can pass raw SPF and still fail DMARC if the domains don't line up - that mismatch is exactly how spoofing is caught.
• Policy. The p tag sets the verdict for failures. p=none only monitors, p=quarantine sends failures to spam, and p=reject blocks them outright. Reject is the goal.
• Subdomain policy. The sp tag sets a separate policy for subdomains, so attackers can't abuse a forgotten marketing.example.com.
• Percentage. The pct tag applies the policy to a fraction of mail, used as a rollout dial. At full enforcement it should be 100.
• Reporting. The rua tag collects aggregate reports - the feedback loop that shows you who is sending mail as your domain before you tighten the policy.

The intended path is simple: start at p=none to observe, fix what's failing, then move to quarantine and finally reject.

Why DMARC matters

A spoofed email that passes through to an inbox can drive a wire transfer, harvest credentials, or damage a brand built over years. SPF and DKIM raise the bar, but without DMARC at enforcement, receivers have no instruction to actually drop a forgery aimed at your "From" address.

p=reject turns that forgery into a bounce before anyone sees it. The reports do the quieter work: they reveal every service sending as your domain - including the legitimate ones you forgot about - so you can reach full enforcement without breaking real mail.

Common DMARC mistakes

• Stuck at p=none. Monitoring forever provides reporting but zero protection. The value is in moving to enforcement.
• No reporting address. Without a rua tag you're flying blind and can't safely tighten the policy.
• Alignment failures. A third-party sender that passes SPF on its own domain still fails DMARC unless it aligns with yours - a common reason legitimate mail breaks at enforcement.
• Weak subdomain policy. Leaving sp open invites subdomain spoofing even when the main domain is locked down.
• Multiple records or bad syntax. A domain must publish exactly one valid DMARC record - duplicates or syntax errors make the policy invalid.

How SecRift checks DMARC

SecRift reads your published DMARC policy and breaks it into seven findings:

• Record publication - confirms exactly one v=DMARC1 record exists at _dmarc.
• Syntax - validates the record against RFC 7489 and flags malformed tags.
• Policy enforcement - checks the p value. reject is strongest, quarantine is partial, and none provides no enforcement.
• Subdomain policy - evaluates sp so subdomains are covered, not just the apex.
• pct enforcement - confirms the policy applies to all mail, not a reduced percentage.
• Reporting - checks for a valid rua URI so you actually receive aggregate reports.
• Identifier alignment - reviews the alignment settings that decide whether a passing SPF or DKIM result counts for your "From" domain.

Each finding includes a plain-language summary and, where needed, one concrete step - for example, adding a rua mailto URI or moving from quarantine to reject. SecRift reads only what you publish in DNS, so the picture matches what receivers see.

DMARC depends on the records beneath it, so a clean SPF setup is the natural first step before you push DMARC to enforcement.

Run a free scan on any domain at secrift.com and see your DMARC posture in seconds.