What is a DMARC Record?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a DNS TXT record that works alongside SPF and DKIM to tell receiving mail servers what to do with emails that fail authentication checks.
When an email arrives claiming to be from yourbank.com, the receiving server checks whether the sending server is authorized (SPF) and whether the message signature is valid (DKIM). If both fail, DMARC decides the outcome.
DMARC Policy Levels Explained
The domain owner receives failure reports but emails are still delivered. This is a starting policy used while transitioning to full enforcement. Not protective against phishing on its own.
Emails that fail authentication are moved to the recipient's spam folder. This provides real protection while still allowing some deliverability for edge cases.
The strictest policy. Emails that fail SPF and DKIM are rejected outright and never reach the inbox or spam folder. This is the gold standard recommended for all established businesses.
Why Does DMARC Matter When Evaluating a Website?
A missing or loose DMARC policy is a meaningful signal when assessing an unknown online store or service:
- Legitimate businesses invest in email security to protect their customers from phishing.
- A domain without DMARC can be used to send convincing fake order confirmations or account alerts.
- Scam operations typically register domains quickly without configuring email authentication.
- A missing DMARC record is an email-configuration observation, not a website trust verdict.
Frequently Asked Questions
What does p=none mean in a DMARC record?
It means monitoring mode — the domain owner receives reports but failing emails are still delivered. It asks receiving systems to monitor without requesting quarantine or rejection. Domain owners may review reports before changing policy.
Is a missing DMARC record a red flag?
A missing record describes email configuration and does not establish whether a website or seller is trustworthy.
Does DMARC protect the website itself?
No — DMARC only protects the domain's email identity. It prevents others from sending phishing emails in your domain's name, but it does not directly affect the security of the website content or user data.