DMARC
A DNS policy that tells receiving servers what to do with mail claiming to be from your domain that fails SPF and DKIM.
DMARC ties the other two together and adds enforcement. The policy can be none, which only reports, quarantine, which sends failures to junk or a hosted quarantine, or reject, which refuses them outright.
A policy of none protects nobody from anyone spoofing your domain. Moving to quarantine and then reject, using the aggregate reports to find legitimate senders first, is the work that actually stops impersonation.
Where this comes up
DMARC sits inside our networks and infrastructure work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Measure this on your own domain
Our free email authentication checker reads this record for any domain over public DNS, grades what it finds, and gives you the exact record to publish if it is wrong. No sign-up.
Check your domain →