What is DMARC and How to Check if Your Domain Has It
If you run a website or send emails from your domain, DMARC is one of the most important security settings you have probably never heard of. Without it, anyone on the internet can send emails pretending to be you — and your recipients will have no way of knowing.
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a DNS record you add to your domain that tells email providers (Gmail, Outlook, etc.) what to do when someone tries to send email pretending to be from your domain.
There are three possible DMARC policies:
- none — monitor only, take no action (weak)
- quarantine — send suspicious emails to spam (better)
- reject — block suspicious emails outright (best)
Without a DMARC record, your domain is wide open to email spoofing. Attackers can send phishing emails that appear to come from your company, damaging your reputation and putting your customers at risk.
What is SPF?
SPF (Sender Policy Framework) is a related DNS record that lists which mail servers are allowed to send email on behalf of your domain. Think of it as a whitelist of approved senders.
A typical SPF record looks like this:
v=spf1 include:_spf.google.com ~all
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. When the recipient mail server receives your email, it checks the signature against a public key stored in your DNS records. If the signature matches, the email is genuine.
Together, SPF, DKIM, and DMARC form the three pillars of email authentication. You need all three for full protection.
Why Does This Matter?
Email spoofing is one of the most common attack vectors for phishing. Over 3 billion spoofed emails are sent every day. Without DMARC, your domain could be used to send phishing emails to your customers, damage your brand reputation, get your legitimate emails marked as spam, and facilitate business email compromise (BEC) fraud.
Large email providers like Gmail and Yahoo now require DMARC for bulk senders. Without it, your emails may not reach inboxes at all.
How to Check if Your Domain Has DMARC
PostureCheck scans your domain for DMARC, SPF, and DKIM records in seconds and gives you a plain-English explanation of what is missing and how to fix it. You can also check manually from the command line:
# Check DMARC nslookup -type=TXT _dmarc.yourdomain.com # Check SPF nslookup -type=TXT yourdomain.com # Check DKIM (replace default with your selector) nslookup -type=TXT default._domainkey.yourdomain.com
How to Add DMARC to Your Domain
- Log in to your DNS provider (Namecheap, GoDaddy, Cloudflare, etc.)
- Add a new TXT record: Host =
_dmarc, Value =v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com - Save and wait up to 48 hours for DNS to propagate
- Re-scan your domain on PostureCheck to confirm it is working
Start with p=quarantine and once you are confident your legitimate emails are passing, upgrade to p=reject for maximum protection.