DMARC (Domain-based Message Authentication, Reporting and Conformance)

securityISP & telecom

The policy layer that requires a passing SPF or DKIM result to belong to the same domain shown in the message's visible From field - called alignment - and publishes what receivers should do with mail that fails, plus where to send reports.

Alignment is the actual protection: SPF and DKIM each authenticate something the reader never sees, and DMARC binds authentication to the address they do see. The reporting half is underrated and is what makes deployment feasible - aggregate reports reveal every system sending as your domain, including the ones nobody documented. Most organisations stall at p=none for years, because reaching enforcement requires an inventory of your own senders that usually does not exist yet.

Also known as: dmarc, alignment, p=none, p=reject, aggregate reports

← All glossary entries