---
title: "DMARC (Domain-based Message Authentication, Reporting and…"
description: "DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox providers should handle messages that fail SPF or…"
canonical: "https://lemwatch.com/glossary/dmarc"
source: "https://lemwatch.com"
---

# DMARC (Domain-based Message Authentication, Reporting and Conformance)

> DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox providers should handle messages that fail SPF or DKIM checks. It is the keystone defence against email spoofing of your domain.

## Definition

 DMARC is published as a TXT record at `_dmarc.<domain>` containing a policy (`p=none`, `p=quarantine`, or `p=reject`) and reporting addresses. Mailbox providers send aggregate reports listing every IP that sent mail claiming to be from your domain — exposing spoofing attempts and legitimate sources you forgot about.

 Progression is usually `p=none` (monitor only) → `p=quarantine` (suspicious mail to spam) → `p=reject` (drop entirely). Most domains stall at `p=none` forever; reaching `p=reject` requires fixing every legitimate sender to authenticate properly.

## Why it matters

 Without DMARC, anyone can forge email from your domain — phishing your customers, your staff, or your suppliers. Gmail and Yahoo now require DMARC for bulk senders; without it, marketing emails can be silently dropped.

 See it in the product: [Email deliverability](https://lemwatch.com/features).


## Related

- [Monitoring glossary](https://lemwatch.com/glossary)
- [DNS](https://lemwatch.com/glossary/dns)
- [Security Headers](https://lemwatch.com/glossary/security-headers)
- [SPF](https://lemwatch.com/glossary/spf)
- [DKIM](https://lemwatch.com/glossary/dkim)
- [All monitoring checks](https://lemwatch.com/features)