Digital Lexicon Hub

An email authentication policy standard that checks SPF and DKIM results against the visible From domain and tells receivers how to treat failures.

DMARC is the main control against attackers sending email that displays a company's own domain, which supports phishing and business email compromise defense, and a DMARC record is required for bulk sending to Gmail and Yahoo.

A company publishes v=DMARC1; p=none; rua=mailto:[email protected], uses aggregate reports for six weeks to find unauthenticated senders such as an old CRM, fixes their SPF and DKIM setup, then moves to p=quarantine and later p=reject.

DMARC protects only the exact domain and its subdomains, not lookalike domains, and a p=none policy monitors without blocking anything. Moving to reject before every legitimate sender is aligned can block valid invoices, alerts or marketing mail.

A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the From header domain, in relaxed or strict mode. The policy is a TXT record at _dmarc.domain with tags such as p, sp, np, rua and ruf. In May 2026 the IETF published RFC 9989, with RFC 9990 and 9991 for reporting, as a Standards Track replacement for RFC 7489; it removes the pct tag and finds the organizational domain through a DNS tree walk.