Business
Business Security · Overview Scope · Domain Audit Shadow · Mailbox Forensics Monitoring · Continuous Coverage Fix Session · Implementation
Individual
Personal Protection · Overview Scope · Personal Credential Scan
Solutions
Dark Web Monitoring Domain Impersonation Protection Credential Breach Detection Compliance Monitoring
Intelligence
Threat Intelligence Global Breach Map Breach Feed
Company
Partners How It Works About Press & Media
Sign In
Cyber-intelligence glossary

DMARC

Domain-based Message Authentication, Reporting, and Conformance

An email authentication protocol that tells receiving mail servers what to do with messages that fail sender authentication (SPF or DKIM).

Definition

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS-published email policy that instructs receiving mail servers how to handle mail claiming to be from a domain but failing SPF or DKIM alignment. Policies range from monitoring only (p=none) through quarantine (p=quarantine) to rejection (p=reject). Domains without DMARC, or with DMARC set to p=none, are effectively spoofable at scale — attackers send email that appears to originate from the domain and receiving servers deliver it because there is no policy instructing them to reject unauthenticated mail. DMARC is standardized in RFC 7489. Auditing DMARC posture across an advisor tenant network is a wire-fraud precursor signal LeakTrace monitors continuously.

Why it matters

Family offices, wealth manager firms, and sports agencies typically hold sensitive wire instructions on advisor tenant infrastructure (CPA, attorney, wealth manager). A weak or missing DMARC policy on any of those advisor domains means an attacker can impersonate that advisor to the principal or counterparty, routing a wire instruction to a fraudulent account. DMARC posture is one of the first signals LeakTrace surfaces on the advisor tenant network.

Related LeakTrace pages
Related program
Family Office Intelligence
Related program
Wealth Manager Program
Related program
Sports Agency Program
Related terms
SPF
A DNS record listing which mail servers are authorized to send email on behalf of a domain.
DKIM
A cryptographic email signing standard that lets receiving servers verify a message was actually sent from the claimed domain and was not modified in transit.
Business Email Compromise (BEC)
A category of wire-fraud attack where the attacker impersonates a trusted party (executive, vendor, advisor) over email to redirect a payment to a fraudulent account.
Wire-fraud precursor
A publicly-observable signal that indicates an attacker is preparing a business-email-compromise or wire-fraud attack against a target — surfaced before the wire moves, not after.
Discovery call
Mutual NDA on request. Reply within one business day.
Book at [email protected]. Full glossary at getleaktrace.com/glossary. Frequently asked questions at getleaktrace.com/faq.