Security
DMARC
Domain-based Message Authentication, Reporting and Conformance
DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox providers should handle messages that fail SPF or DKIM checks. It is the keystone defence against email spoofing of your domain.
In depth
DMARC is published as a TXT record at `_dmarc.<domain>` containing a policy (`p=none`, `p=quarantine`, or `p=reject`) and reporting addresses. Mailbox providers send aggregate reports listing every IP that sent mail claiming to be from your domain — exposing spoofing attempts and legitimate sources you forgot about.
Progression is usually `p=none` (monitor only) → `p=quarantine` (suspicious mail to spam) → `p=reject` (drop entirely). Most domains stall at `p=none` forever; reaching `p=reject` requires fixing every legitimate sender to authenticate properly.
Why it matters
Without DMARC, anyone can forge email from your domain — phishing your customers, your staff, or your suppliers. Gmail and Yahoo now require DMARC for bulk senders; without it, marketing emails can be silently dropped.
How Lemwatch helps with dmarc
Lemwatch monitors dmarc continuously and alerts you the moment something changes.
Email deliverability →Related terms
DNS
The Domain Name System (DNS) is the distributed database that translates human-readable domain names like lemw…
Security Headers
Security headers are HTTP response headers that instruct browsers to enforce additional defences against commo…
DKIM
DomainKeys Identified Mail (DKIM) is an email authentication standard that adds a cryptographic signature to e…
SSL/TLS
SSL/TLS is the cryptographic protocol that secures HTTPS connections. It encrypts traffic between browser and …
CSP
Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scrip…
Browse the full Lemwatch monitoring glossary (47 terms).