What is DMARC?
DMARC is the record a domain publishes to tell receiving mail servers what to do with email that claims to come from it and fails the checks.
Last read from the sources at the foot of this page.
What does DMARC mean?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting, that a mail-receiving organization can use to improve mail handling.
The record sits at one fixed name, _dmarc in front of the domain, as a line of text that begins v=DMARC1. Its most important part is the policy, written p=. At p=none the firm asks for nothing to be done. At p=quarantine failing mail is treated as suspect. At p=reject it is refused.
DMARC rests on two older records. SPF lists the servers allowed to send for the domain; DKIM signs each message. A message passes DMARC when one of the two passes for the same domain the recipient sees in the From line, which is the address a forger copies.
The record also names an address for reports. Receiving servers send a daily summary of the messages that used the domain, so the firm learns which services send in its name before it moves the policy to reject.
Where does it show up in a reading?
In a LeakTrace reading it is read under “Forged email in your name”: the records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM), read externally.
A record that is missing, or set to p=none, is listed as an open way in.
Which pages use this term?
Where does this come from?
- RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)rfc-editor.orgRead 1 November 2026
See what is open before anyone else does.
We read your domain externally and show each way in with a check anyone can re-run.