What DMARC Actually Stops (And Why Most Domains Still Don't Have It)
SPF gets set up fairly often. DMARC, the record that actually makes SPF mean something, gets skipped almost as often. Here's the difference, in plain terms.
SPF tells receiving mail servers which servers are allowed to send mail for your domain. That sounds like enough — but SPF on its own is more of a suggestion than an enforcement mechanism, for one important reason: SPF failures don't have to result in the email being blocked. Whether a failed check gets rejected, quarantined, or quietly ignored is entirely up to the receiving mail provider's own defaults, and those vary.
DMARC closes that gap
DMARC sits on top of SPF and DKIM and does two things SPF can't do alone:
- It lets you, the domain owner, explicitly declare what should happen when a message fails authentication —
p=none(just monitor),p=quarantine(send to spam), orp=reject(block outright). - It gives you aggregate reports showing who is sending mail using your domain — including, often, the first real evidence that someone is actively spoofing you.
Why "p=none" isn't really protection
A huge number of domains that do have a DMARC record are sitting on p=none, usually left there from initial setup and never revisited. That setting is genuinely useful as a monitoring phase — it lets you see what's sending mail as your domain before you start blocking anything — but it enforces nothing. A spoofed email still lands in the inbox exactly as before. Moving to quarantine and eventually reject is the step that actually stops anything, and it only happens once you've confirmed your real mail sources are properly aligned so you don't accidentally block your own newsletters or invoices.
What DMARC doesn't stop
It's worth being precise here: DMARC protects your exact domain from being spoofed. It does nothing about a lookalike domain — yourcompany-billing.com instead of yourcompany.com — which is a separate, common phishing tactic that no DNS record can fully solve. DMARC is one layer, not a complete answer.
Checking where you stand
Most domain owners genuinely don't know whether they have SPF, whether DMARC exists at all, or what policy it's set to. It's a two-minute DNS lookup to find out.