DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox providers should handle messages that fail SPF or DKIM checks. It is the keystone defence against email spoofing of your domain.
DMARC is published as a TXT record at `_dmarc.<domain>` containing a policy (`p=none`, `p=quarantine`, or `p=reject`) and reporting addresses. Mailbox providers send aggregate reports listing every IP that sent mail claiming to be from your domain — exposing spoofing attempts and legitimate sources you forgot about.
Progression is usually `p=none` (monitor only) → `p=quarantine` (suspicious mail to spam) → `p=reject` (drop entirely). Most domains stall at `p=none` forever; reaching `p=reject` requires fixing every legitimate sender to authenticate properly.
Without DMARC, anyone can forge email from your domain — phishing your customers, your staff, or your suppliers. Gmail and Yahoo now require DMARC for bulk senders; without it, marketing emails can be silently dropped.
See it in the product: Email deliverability.