DMARC: why SPF alone does not stop spoofing
SPF checks a field users never see. DMARC is what protects the From: line they do — and it starts in observation mode for a reason.
Updated July 27, 2026
SPF validates the envelope sender — a technical field invisible in mail clients. An attacker can pass SPF using their own domain in the envelope while showing YOUR domain in the From: header the victim reads. DMARC closes that hole: it requires the visible From: to align with the domain that passed SPF (or DKIM), and tells receivers what to do when it does not.
dig _dmarc.example.com TXT +shortThe policy ladder
- p=none — observe only: nothing is blocked, but you receive reports (rua=) showing who sends as your domain. Start here.
- p=quarantine — failures go to spam.
- p=reject — failures are refused outright. The goal, reached after reading reports.
Starting at p=reject without reading reports first is the fastest way to block your own newsletters, invoicing tools and CRM — every legitimate service you forgot authenticates on your behalf. Observe first, tighten after: the reports exist precisely to make reject safe.
See it on your own domain
The free DNS checker runs these exact checks — delegation, DNSSEC, e-mail, TTLs — on any domain.