📧

DMARC — Email Authentication

Medium

Free preview · 2 of 6 steps

DMARC: policy layer over SPF and DKIM

SPF says which servers can send email for your domain. DKIM cryptographically signs messages. But without DMARC, a receiving server doesn't know what to *do* when they fail — deliver anyway?

DMARC publishes a DNS policy: "If SPF and DKIM both fail for my domain, reject/quarantine the message and tell me about it." It's the enforcement layer that stops email spoofing.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step