Domain-based Message Authentication, Reporting & Conformance (DMARC)
A policy layer built on SPF and DKIM that tells receivers what to do when email fails authentication, and sends you reports about what's being sent as your domain.
What DMARC is
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy that ties SPF and DKIM together. It tells receiving mail servers what to do when a message fails authentication.
A DMARC policy can be set to none (monitor only), quarantine (send failing mail to spam), or reject (block it entirely). It also specifies alignment — whether the domains validated by SPF or DKIM match your visible From: domain.
DMARC can also request reports, giving you visibility into what's being sent as your domain — including unauthorized sources you may not know about.
Why DMARC matters for your firm
SPF and DKIM on their own don't enforce anything. DMARC is the layer that turns authentication into a decision: monitor, quarantine, or reject.
For accounting firms, a spoofed email impersonating your practice can trick a client into sending documents or payment to an attacker. DMARC enforcement directly reduces that risk.
Many firms publish DMARC but leave it at none indefinitely. Moving toward enforcement — carefully, to avoid blocking legitimate mail — is where the real protection comes from.
What we look at
- Whether a DMARC record is published for your domain.
- The policy level in use (none, quarantine, or reject).
- Whether SPF and DKIM align with your visible From: domain.
- Whether reporting addresses are configured and whether the policy is enforced.
This review uses publicly available information and does not log into private systems or access private client records. Any deeper testing that requires authorization only takes place after you authorize it and the scope is agreed upon.
Keep exploring
See how DMARC applies to your firm.
The RingWarden Professional Security Assessment reviews dmarc and the rest of your public-facing digital infrastructure, then delivers a clear written report.
One-time payment. Professional written report. Delivered within 3 business days of confirmed payment, subject to the necessary assessment scope and access arrangements.