DMARC is an email authentication standard that lets a domain owner tell receiving servers what to do with mail that falsely uses its domain in the From address, and receive reports about it.
DMARC builds on SPF and DKIM. A domain publishes a DNS record at _dmarc.<domain>, beginning v=DMARC1, with a policy — none (monitor only), quarantine (treat as suspicious) or reject — that applies when a message fails authentication aligned with the visible From domain. Receivers can also send the domain owner aggregate reports showing who is sending mail in its name.
The original specification, RFC 7489 (2015), was an informational document. In 2026 it was replaced by RFC 9989, a standards-track version of DMARC; existing v=DMARC1 records continue to work.
In practice
A domain with an enforced DMARC policy (quarantine or reject) is much harder to spoof in phishing emails, and its reports reveal impersonation campaigns early. DMARC protects only your exact domain: attackers often switch to lookalike domains, which need a takedown through the registrar or host instead. Large mailbox providers now expect bulk senders to publish a DMARC record.
Source: RFC 9989 — DMARC (obsoletes RFC 7489) ↗
Related removals
- Brand protection — Custom engagement, pay on success
Related terms
- SPF (Sender Policy Framework) — SPF is an email authentication standard in which a domain publishes, in DNS, the list of servers allowed to send email on its behalf.
- DKIM (DomainKeys Identified Mail) — DKIM is an email authentication standard in which the sending domain adds a cryptographic signature to each message, which receivers verify against a public key published in DNS.
- Phishing — Phishing is a fraud in which attackers impersonate a trusted brand or person, by email, text or a fake website, to trick people into handing over passwords, payment details or money.
- Impersonation — Online impersonation is pretending to be a real person or organisation — through a fake profile, website, email or ad — in a way that misleads people about who is behind it.
- Website takedown — A website takedown is the removal of an unlawful website through the lawful channels of its hosting provider, domain registrar, CDN and search engines.