DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It's a DNS record that tells the world's mail servers what to do with emails that claim to come from your domain but fail authentication checks.
In plain terms: DMARC is the last line of defence against someone impersonating your email.
Why DMARC exists
SPF and DKIM are useful, but they have a gap: even if an email fails both checks, receiving mail servers have no clear instruction on what to do with it. Some reject it. Some deliver it anyway. DMARC closes that gap by giving you control over the outcome.
What DMARC does
1. Sets a policy. You choose what happens to emails that fail authentication:
- p=none — monitor only, deliver everything (good starting point)
- p=quarantine — send failures to spam
- p=reject — block failures entirely
2. Aligns SPF and DKIM with your domain. DMARC checks that the authenticated domain matches the "From" domain the recipient sees — closing the gap that let spoofed emails slip through even with SPF in place.
3. Sends you reports. You get regular reports showing who is sending email from your domain, what's passing, and what's failing.
Does your site need DMARC?
If your domain is used for any email — to customers, suppliers, newsletters, support — then yes. Without it, anyone can send email appearing to come from your domain and you'll have no visibility into whether it's happening.
Even parked domains with no email should have p=reject to prevent use in spoofing campaigns.
threatprobe.app's free scan checks for SPF, DKIM, and DMARC and tells you in plain language whether each is present and correctly configured.