Glossary · Email & infrastructure
DMARC
DMARC (RFC 7489) is a DNS policy record tying SPF and DKIM together: it requires one to align with the visible From address, tells receivers what to do on failure, and requests reporting on the results.
SPF and DKIM can each pass while still allowing spoofing, because neither is required to match the domain a human actually sees in their inbox. DMARC closes that gap with alignment: it demands that the domain in SPF or DKIM correspond to the visible From header, not just some technically valid but unrelated domain. A message that fails alignment on both checks fails DMARC, regardless of whether SPF or DKIM individually passed.
DMARC’s policy tag (p=none, p=quarantine, or p=reject) tells receiving mail servers what to do with messages that fail — none just monitors, quarantine sends them to spam, and reject refuses delivery outright. Most domains start at p=none while reviewing DMARC aggregate reports, then tighten to reject once they have confirmed every legitimate sending source passes.
Ciphera Relay enforces a DMARC reject policy — mail claiming to be from a Relay-protected domain that fails both SPF and DKIM alignment is refused, not quarantined for a human to second-guess.