DMARC
A policy protocol instructing servers how to handle emails that fail SPF or DKIM checks.
A policy protocol instructing servers how to handle emails that fail SPF or DKIM checks.
Why It Matters
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails (nothing, quarantine, or reject). It also enables reporting so you can see who's sending email as your domain—legitimate or fraudulent. Gmail and Yahoo require DMARC for bulk senders.
Practical Example
Scenario
A skincare brand discovers through DMARC reports that their domain is being spoofed in phishing attempts targeting their customers.
Calculation
DMARC aggregate reports show 500 emails/day failing authentication from unknown IPsResult
They move from p=none (monitoring) to p=quarantine, then p=reject. Spoofed emails now go to spam or are rejected entirely, protecting customers and brand reputation.
Pro Tips
- 1Start with p=none to monitor without affecting delivery, then gradually increase enforcement
- 2Set up DMARC reporting (rua= tag) to receive aggregate reports about authentication results
- 3Ensure all legitimate sending sources pass SPF or DKIM before enforcing p=reject
- 4Use DMARC reporting services (Valimail, Dmarcian) to interpret reports easily
Common Mistakes to Avoid
Frequently asked questions
Put it to work
Related Terms
ONE FREE AUDIT
Run your free Shopify audit.
50+ factors. Real fixes. Same framework we run for $10M brands.
Free · No credit card required
You'll talk directly to the people doing the work.
7.7x blended return at scale — seven figures attributed, across five straight quarters · Modern Prairie · Apr 2025–Jun 2026 Read the Modern Prairie case study
