DMARC

How it works

• It builds on SPF and DKIM: a message must pass at least one of them, and match your domain.
• The policy says what receivers do with failures: none, quarantine or reject.
• Reports show who is sending mail as your domain, legitimate or not.
• The safe path is to start at none, fix the legitimate senders, then tighten to quarantine and reject.

What can go wrong (example scenario)

A four-person property management firm had SPF and DKIM but no DMARC. Phishers spoofed their From address to tenants, asking that rent be sent to a new e-transfer. Inboxes had no instruction to reject, so the messages landed.

How WILDCARD handles it

Domain Security publishes DMARC, reads the reports, adds any missing legitimate senders to SPF and DKIM, and moves the policy from none to quarantine to reject once the reports are clean.

• A law firm wants proof to clients that emails from its domain are genuine. DMARC at p=reject is that proof.
• A retailer finds, through DMARC reports, that an old marketing vendor is still sending as their domain.
• A non-profit applying for a grant is asked whether email authentication is in place. A DMARC record answers yes.

Example scenario: A two-person insurance brokerage turned on DMARC in monitor mode. The first week's reports showed hundreds of messages from servers in three countries pretending to be them. Moving to p=reject stopped those messages reaching anyone's inbox, and the brokerage never had to call a single client to explain.

A question owners ask

Will DMARC block my own emails?

Only if a legitimate sender is missing from SPF and DKIM. That is why we start at p=none, read the reports, and fix every real sender before tightening.