Home / Core Health / Implement DMARC policy to prevent email spoofing
Email Deliverability · Scan Check Guide

Implement DMARC policy to prevent email spoofing

30 min Impact: high Effort: medium ✓ Scan-verified — no manual checkbox

DMARC tells receiving mail servers what to do when an email claiming to be from your domain FAILS SPF or DKIM checks — without it, even with SPF and DKIM correctly set up, there's no enforcement, and spoofed email can still land in recipients' inboxes.

DMARC tells mail servers what to do when SPF or DKIM fails. Without it, your domain is completely unprotected against email spoofing. Gmail and Yahoo now require DMARC — without it your emails may be rejected entirely.

The full picture

DMARC (Domain-based Message Authentication, Reporting, and Conformance) provides the genuine policy layer that determines what actually happens when an incoming message fails the SPF and DKIM checks those underlying protections provide — without DMARC, receiving mail servers have inconsistent, server-specific approaches to handling authentication failures, undermining the practical protection those foundational checks are meant to provide.

DMARC explicitly instructs receiving mail servers on your preferred handling for messages that fail authentication — whether to quarantine them, reject them outright, or simply monitor and report on failures without taking direct action, giving you genuine, explicit control over how strictly your domain's email authentication gets enforced.

The reporting mechanism this protocol provides offers genuine, practical value beyond policy enforcement alone — DMARC reports give you real visibility into who's actually sending email claiming to be from your domain, including any spoofing attempts, providing concrete evidence of both legitimate sending sources you might have forgotten to authorize and genuine fraudulent activity worth investigating.

The genuine implementation discipline this protocol rewards is gradual escalation — starting with a monitoring-only policy before progressing to more restrictive quarantine or rejection policies allows you to verify your SPF and DKIM configurations are genuinely accurate before enforcing stricter handling that could otherwise inadvertently block your own legitimate email if those underlying records contain errors.

How to fix it

  1. 1
    Confirm SPF and DKIM are already set up
    DMARC builds on top of both — it needs at least one of them correctly configured to function meaningfully.
  2. 2
    Start in monitor mode
    v=DMARC1; p=none; rua=mailto:[email protected] — this collects reports without blocking anything, so you can see what's happening before enforcing.
  3. 3
    Review reports for a few weeks
    DMARC reports show you every source sending email as your domain — confirm everything showing up is actually legitimate.
  4. 4
    Move to enforcement
    Once confident, tighten to p=quarantine (suspicious mail goes to spam) and eventually p=reject (blocked outright) as your confidence grows.

Common mistakes

How you'll know it's done

A DMARC record exists, reports are being reviewed, and policy has progressed from monitor-only toward enforcement.

Tools that help

H.I.V.E. checks this automatically

Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.

Run this check in H.I.V.E. →