Tell Inboxes What to Do With Fakes (DMARC)

medium

Learn with your AI

Pick a depth. Each prompt opens in your AI pre-loaded with the lesson. Click a row to preview the prompt.

Or teach me the whole lesson:

Why this matters

DMARC builds on SPF and DKIM by telling receivers what to do when authentication fails — quarantine, reject, or monitor — giving domain owners active control over spoofed mail. Without a DMARC policy, passing SPF and DKIM alone offers no enforcement.

Try it yourself

Look up your domain's DMARC record with dig TXT _dmarc.yourdomain.com and identify the current p= value (none, quarantine, or reject).
Set up a DMARC reporting address (rua=) on a subdomain and after 24 hours open the XML aggregate report — count how many sources are sending mail as your domain.
Change a test subdomain's DMARC policy from p=none to p=quarantine and send a deliberately SPF-failing message to a Gmail address to verify it lands in spam.

References

RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance