DMARC (Domain-based Message Authentication)
What a DMARC record does, why p=none leaves your domain spoofable, and the step-by-step path from monitoring to p=reject enforcement without breaking mail flow.
What it is
DMARC is a DNS TXT record (_dmarc.yourdomain.com) that tells receiving mail servers what to do with email that fails SPF/DKIM checks: nothing (p=none), quarantine (p=quarantine), or reject (p=reject). It also enables aggregate reports so you can see who's sending as you.
Why it matters
Without DMARC at p=reject, anyone can send email as your domain — phishing your customers, partners, and staff. 48% of domains we scan have no DMARC policy at all, meaning they're fully spoofable.
How to fix it
See if your site passes
Check your DMARC record freeFAQ
How long does DMARC rollout take?
Typically 2–4 weeks: start at p=none, review aggregate reports to find all legitimate senders, move to quarantine, then reject.
Do I need SPF and DKIM first?
Yes. DMARC builds on them — at least one must pass and align with your domain for mail to be delivered under p=reject.
More explainers: HSTS (HTTP Strict Transport Security) · Content-Security-Policy (CSP) · Cookie Consent (GDPR/ePrivacy) · SPF (Sender Policy Framework) · DKIM (DomainKeys Identified Mail) · X-Frame-Options / frame-ancestors · llms.txt (AI Crawler Guidance) · all checks