DMARC management platform
Sendmarc’s DMARC management platform delivers enterprise-grade features to enforce, monitor, and optimize DMARC across any domain environment.
With fanatical support, audited security controls, and unlimited scalability, Sendmarc is built for organizations that take email authentication seriously.
Whether securing a few domains or thousands, Sendmarc provides the infrastructure, visibility, and assurance required to meet any DMARC requirements.
Enterprise features for all
DMARC, SPF, DKIM, BIMI, MTA-STS, and TLS-RPT management with advanced reporting, policy control, and threat intelligence.
Unbeatable support
Sendmarc guarantees DMARC compliance on time and on budget – we promise full protection within 90 days* for businesses of all sizes.
*For customers on Sendmarc’s Premium Plan, subject to the number of domains.
Certified, compliant, & secure
ISO 27001 and SOC 2 certified, Sendmarc offers world-class data security, internal controls, and auditing capabilities; we’ve created our platform with privacy and integrity in mind.
Limitless scale
Scale up to the demands of global enterprises; manage millions of records and thousands of domains with a built-in ranking structure and access control.
Enterprise DMARC capabilities for all
Analysis & reporting
Policy management
User security & access management
Integrations & compliance
Partners, MSPs, & VARs
Start your DMARC journey today
Register
Get instant access to Sendmarc’s DMARC management platform
Activate
Input your business and domain details
Implement DMARC
Connect with us to get support during your DMARC journey and guarantee success
What is DMARC (Domain-based Message Authentication, Reporting, and Conformance)?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol that builds on Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to help secure your organization’s domain and stop cybercriminals from using it in email impersonation and spoofing attacks.
DMARC provides three core benefits:
- DMARC protects your business’s domain by blocking fraudulent emails and safeguarding customers, suppliers, employees, and external recipients
- DMARC improves email delivery and inbox placement for authenticated email sources like your company’s CRM, ERP, marketing tools, and primary email services
- DMARC provides visibility into all emails sent on behalf of your organization’s domain, both legitimate and malicious
If your business sets up a DMARC record in its DNS, it can monitor services sending email from its domain and enforce policies that prevent spoofing and impersonation.
Sendmarc’s DMARC management platform provides everything your company needs to manage DMARC, SPF, DKIM, Mail Transfer Agent Strict Transport Security (MTA-STS), Transport Layer Security Reporting (TLS-RPT), and Brand Indicators for Message Identification (BIMI), supported by Sendmarc’s award-winning DMARC implementation services.
Why is DMARC important for email security?
Email communication wasn’t originally created with identity verification in mind. This means cybercriminals can send emails from your organization’s domain and target customers, employees, or suppliers.
Email impersonation and spoofing attacks often lead to:
- Invoice fraud and deposit scams
- Man-in-the-Middle (MitM) attacks
- Phishing attempts
Traditional email security tools primarily protect internal users. This leaves external recipients, such as customers and suppliers, vulnerable to spoofed emails.
DMARC offers the following benefits:
- Stops domain impersonation by blocking spoofed emails from your business’s domain before they reach inboxes
- Improves inbox placement for legitimate and authenticated emails
- Provides detailed reports on all services sending email on behalf of your company’s domain, both legitimate and malicious
How does DMARC work?
DMARC uses SPF and DKIM results to check if a message should be trusted.
Here’s how it works:
- An email is received
- The receiving server verifies whether the message passes SPF or DKIM checks and if those align with the ‘From’ domain
- Based on the DMARC policy (p=none, p=quarantine, or p=reject), the server decides how to handle unauthenticated messages
- Your organization receives DMARC reports to track activity and adjust enforcement
DMARC record example
A DMARC record is published in your business’s domain DNS settings as a TXT record. Below are examples of both a basic and an advanced DMARC record.
Basic DMARC record:
| Host | Type | Value |
|---|---|---|
| _dmarc.yourdomain.com | TXT | v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1; |
This record tells email providers to reject unauthenticated messages and send aggregate reports to [email protected].
Advanced DMARC record:
| Host | Type | Value |
|---|---|---|
| _dmarc.yourdomain.com | TXT | v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; aspf=s; adkim=s; fo=1; |
This advanced DMARC record applies a policy of p=quarantine to all unauthenticated messages. It sends aggregate reports to [email protected] and forensic reports to [email protected]. It also enforces a policy of p=reject on subdomains, uses strict alignment for SPF and DKIM, and enables failure reporting.
| Host | Type | Value |
|---|---|---|
| _dmarc.yourdomain.com | TXT | v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; aspf=s; adkim=s; fo=1; |
How to create a DMARC record
Step 1: Define the DMARC policy:
Decide how unauthenticated messages should be handled:
- p=none: Monitor only
- p=quarantine: Send to Spam
- p=reject: Block unauthenticated messages
It is best to start with p=none to collect data before moving toward stricter enforcement.
Step 2: Add an RUA reporting address
Choose an inbox to receive aggregate DMARC reports, for example, rua=mailto:[email protected].
Make sure this inbox can process XML-formatted data. For proper alignment, the domain of the reporting address should match your company’s sending domain.
Step 3: Publish the DMARC DNS record
| Host | Type | Value |
|---|---|---|
| _dmarc.yourdomain.com | TXT | v=DMARC1; p=none; rua=mailto:[email protected]; |
Use Sendmarc’s DMARC policy manager to generate, validate, and publish your organization’s record correctly.
Step 4: Monitor & analyze DMARC reports
Your business will start receiving DMARC reports within 24 to 48 hours. These XML-based reports can be difficult to read manually. Our DMARC analyzer automatically processes DMARC data, providing clear, actionable insights to help your company identify unauthorized senders, monitor compliance, and move toward full protection.
Benefits of DMARC
Implementing DMARC can significantly improve the security, deliverability, and visibility of your organization’s email.
Key benefits include:
- Prevents spoofing and phishing attacks by blocking unauthorized senders from using your business’s domain
- Improves inbox placement and strengthens the sender reputation of your company’s legitimate email services
- Builds customer trust by verifying your organization’s email identity and ensuring authenticity
- Provides full visibility into all sources that are sending emails on behalf of your business’s domain, both legitimate and malicious
- Reduces the risk of your company’s domain being blacklisted or flagged as Spam
With DMARC in place, your organization’s email becomes a trusted source, strengthening brand reputation and minimizing email-based threats.
Common DMARC mistakes & misconfigurations
The most critical DMARC mistake is moving to a p=reject policy too quickly without analyzing your business’s DMARC reports. If a legitimate email service doesn’t have properly aligned SPF or DKIM records, those messages will fail authentication checks. As a result, legitimate emails may be rejected by receiving servers, which can negatively impact operations and email deliverability.
Other common DMARC misconfigurations include:
- Missing
RUAaddress for DMARC reports - Publishing multiple DMARC records (only one is allowed per domain)
- Multiple SPF records instead of a single merged one
- Misconfigured percentage (
pct) value, leading to unexpected policy application - Overlooking subdomain reporting and configuration
If your company needs help with DMARC implementation or configuration, Sendmarc’s award-winning support team is here to assist. Our DMARC management platform ensures safe and correct configuration from the start.
DMARC, SPF, & DKIM: What do they mean?
DMARC is an email authentication protocol that builds on SPF and DKIM to protect your organization’s domain from impersonation and spoofing attacks. While these three standards are related, they serve different purposes. The table below outlines their functions and how each is configured.
Protocol | Purpose | Configuration |
| SPF | Authorizes sending IPs | DNS TXT record |
| DKIM | Digitally signs messages | Email headers & DNS TXT record |
| DMARC | Enforces policy and reports | DNS TXT record |
Using DMARC, SPF, and DKIM together creates a strong foundation for preventing email impersonation and spoofing. It also enhances the effectiveness of your business’s overall email security strategy.
DMARC FAQs
What is a DMARC record?
A DMARC record is a DNS TXT entry that tells receiving servers how to handle unauthenticated messages and where to send reports.
Do I need DMARC if I already have SPF or DKIM?
Yes. DMARC aligns SPF and DKIM with the domain in the ‘From’ header and adds policy enforcement and reporting capabilities.
Can I publish more than one DMARC record?
No, only one DMARC record is allowed per domain. Subdomains can have their own DMARC records, which might be different from the policy set on the root domain.
What does it mean if DMARC fails?
A DMARC fail means the message failed both SPF and DKIM alignment checks and didn’t comply with the domain’s DMARC policy.
How can I validate my DMARC record?
Use Sendmarc’s DMARC checker to test and validate your company’s setup.
What if my DMARC policy is incorrect?
Incorrect DMARC policies can block valid messages or may fail to prevent spoofing. Start with a p=none policy, then progress to p=quarantine or p=reject.
Does DMARC prevent all phishing?
DMARC significantly reduces domain spoofing but should be part of a wider security strategy that includes user training.
Interested in adopting DMARC at your organization?
Check out how Sendmarc simplifies the implementation and management of DMARC.
