DMARC
Email MarketingAlso: Domain-based Message Authentication, Reporting and Conformance
Quick definition
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is an email authentication protocol that tells receiving mail servers what to do when an email claiming to be from your domain fails authentication checks. It builds on two other protocols, SPF and DKIM, and requires both to work.
How it varies across Australia
DMARC adoption across Australian businesses trails global averages, particularly in mid-market and small business. Many domains have a DMARC record in monitoring-only mode but have never moved to an enforcement policy, which means they are collecting reports but not blocking spoofed mail.
See email deliverability and authentication patterns across Australian industries →The three protocols that work together
A DNS record that lists which mail servers are authorised to send email for your domain.
Layer 1: who is allowed to sendA cryptographic signature attached to outgoing mail that receivers use to verify the message hasn't been altered.
Layer 2: is the message genuineThe policy layer that tells receivers what to do when SPF or DKIM fail, and where to send reporting data.
Layer 3: what to do on failureWhat it actually means
DMARC is the third layer of email authentication. The first layer is SPF (Sender Policy Framework), which lists which servers are allowed to send email on behalf of your domain. The second is DKIM (DomainKeys Identified Mail), which adds a cryptographic signature to outgoing messages so receivers can verify they haven't been tampered with. DMARC sits on top of both and answers the question: what should happen when a message fails those checks?
You publish a DMARC record in your domain's DNS settings. That record tells receiving mail servers three things: how to handle messages that fail (none, quarantine or reject), where to send aggregate reports about what's passing and failing, and whether SPF and DKIM need to align with the From address.
The policy you choose matters enormously. A policy of none means you're in monitoring mode: emails still deliver, you get data. A policy of quarantine pushes failing mail to spam. A policy of reject drops it entirely. Most businesses stay on none forever because moving to enforcement requires confidence that your own legitimate mail is set up correctly first.
Deliverability and spoofing protection both improve when DMARC is enforced. Google and Yahoo now require a DMARC record in monitoring mode at minimum for anyone sending bulk email. Without one, inbox placement rates drop and the risk of your domain being used in phishing campaigns rises sharply.
A DMARC record on p=none is a smoke alarm with no batteries. It watches, but it does not act.
How it shows up
DMARC shows up in three places. First, in your DNS zone as a TXT record at _dmarc.yourdomain.com. Second, in the inbox or spam folder of recipients: a domain with DMARC enforcement on reject will stop spoofed mail from landing at all. Third, in the aggregate reports sent to the address you specify in the record, which arrive as XML files and show pass and fail rates across all mail streams claiming your domain.
For marketers, DMARC shows up most visibly in deliverability: senders without a DMARC record, or with one set to none that hasn't been maintained, tend to see higher rates of spam filtering and lower inbox placement over time.
The Australian context
Australian businesses sending transactional email at volume need a DMARC record to comply with Google and Yahoo's 2024 bulk sender requirements. The Australian Signals Directorate (ASD) has also included DMARC in its Essential Eight adjacent guidance on email security hardening.
Australian consumer brands that have had their domain impersonated in phishing campaigns carry real liability exposure under the Privacy Act if that impersonation leads to customer data being harvested. DMARC enforcement is one of the few technical controls that directly reduces this surface area. The ACSC (Australian Cyber Security Centre) publishes guidance on email authentication that is worth reading alongside any DMARC implementation.
Where people get this wrong
Related terms
Common questions
Do I need DMARC if I already have SPF and DKIM?
Yes. SPF and DKIM authenticate sending infrastructure and message integrity separately. DMARC is what ties them together, enforces alignment with the From address your recipients actually see, and gives you the reporting to know what is passing and failing. Without DMARC, receivers have no instruction on what to do when SPF or DKIM fail.
What DMARC policy should I start with?
Start with p=none and an rua address for aggregate reports. Monitor for two to four weeks, identify all legitimate mail streams, confirm SPF and DKIM are passing for each, then move to p=quarantine. Move to p=reject once quarantine shows near-zero false positives on your legitimate mail.
Will DMARC stop all phishing using my domain?
Enforcement mode (p=reject) stops spoofed mail that fails alignment from reaching inboxes at receivers who honour DMARC policies. It does not stop lookalike domains (for example, your-brand-support.com) or display name spoofing where the From address is unchanged. DMARC is one control, not a complete defence.
How does DMARC affect email deliverability?
A published DMARC record, even in monitoring mode, is a positive trust signal with major mailbox providers. Google and Yahoo's 2024 bulk sender requirements made a DMARC record mandatory for high-volume senders. Missing it risks mail being filtered or rejected outright. Enforcement mode also prevents your domain being used in phishing, which protects your sender reputation long term.
Debrief
Get the next one
No spam. No fluff. Just the next article, straight to your inbox.
Keep exploring
About New Rebellion
New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.
How we think →