DNS & Glossary

DMARC (Domain-based Message Authentication)

The policy layer over SPF and DKIM: it tells receivers what to do with mail that fails authentication (none, quarantine, reject) and delivers reports on who is sending as your domain.

What it is

A DMARC record at _dmarc.<domain> sets a policy — p=none, p=quarantine or p=reject — applied when a message fails both SPF and DKIM alignment. Aggregate (rua) reports show you every source sending as your domain, so you can reach enforcement safely.

DNS TXT
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s"

Why it matters

  • It is what actually stops spoofed mail using your domain from reaching inboxes.
  • Reports reveal shadow senders before you enforce a strict policy.

Common mistakes

  • Jumping straight to p=reject without first monitoring with p=none, blocking legitimate mail.
  • Publishing DMARC without functioning SPF and DKIM, so nothing aligns.

How WebInspect checks this

  • The Network Inspector reads the DMARC record and reports the policy and alignment settings.