# DMARC

DMARC is a DNS-published email policy that tells receivers what to do with messages that fail SPF and DKIM alignment for a domain, and reports such failures back to the owner.

## How it works

The record at _dmarc.example.com sets a policy (none, quarantine or reject) and reporting addresses. A message passes when SPF or DKIM passes for a domain aligned with the visible From address.

Without an enforcing policy, attackers can send mail that shows your exact domain in the From line.

## How to protect yourself

- Publish DMARC, monitor the reports, then move to quarantine or reject.
- Check the policy of any domain before trusting mail from it.

## Related tools

- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)
- [Email Header Parser](https://phishdestroy.io/developer-tools/email-header-parser)

## Related terms

- [SPF](https://phishdestroy.io/glossary/spf/)
- [DKIM](https://phishdestroy.io/glossary/dkim/)
- [BIMI](https://phishdestroy.io/glossary/bimi/)
- [MTA-STS](https://phishdestroy.io/glossary/mta-sts/)
- [Business email compromise (BEC)](https://phishdestroy.io/glossary/bec/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/dmarc/