DMARC
In email security, DMARC is a policy that tells receiving mail servers what to do with a message that fails authentication and lets a domain owner collect reports on who is sending as their domain. It is the control that decides whether a spoofed phishing email is delivered, and the first thing checked on any external assessment.
How it works
DMARC builds on two earlier mechanisms that must be understood in their own right, not as other names for DMARC. SPF (Sender Policy Framework) publishes, in DNS, which servers are allowed to send mail for a domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message so the receiver can verify it was not altered and came from the signing domain. DMARC ties these together: it checks that the domain a human sees in the “From” field aligns with the domain that SPF or DKIM validated, and it publishes a policy (none, quarantine or reject) telling receivers how to treat mail that fails. It also requests aggregate reports, so the owner learns which sources are sending under their name. SPF, DKIM and DMARC are three separate protocols deployed separately.
What goes wrong
The policy is the whole point, and it is usually the gap. A domain publishes DMARC set to “none”, which asks the receiver to do nothing but report, so a spoofed message still lands. From the attacker’s side, an unenforced or missing policy means an email that appears to come from the target’s own domain is delivered, which is the precondition for convincing spear phishing and for business email compromise. Even where the policy is “reject”, a common error is an SPF record so permissive, or so many subdomains left uncovered, that alignment passes for infrastructure it should not. Enforcement without coverage is a false sense of safety.
Where this shows up in an audit
We test whether the domain can be spoofed in practice: the published SPF, DKIM and DMARC records, the enforcement level, subdomain coverage, and whether a message forging the domain actually reaches an inbox. The finding is written against the policy or coverage gap, with a spoofed delivery demonstrated where scope allows. It connects directly to digital risk protection, since look-alike domains are the next move when the real one cannot be spoofed. This is part of how we test whether your domain can be spoofed.