What DMARC Verifies and What It Cannot Detect

What DMARC was designed to solve

Email spoofing works because the From address in an email is easy to forge. A sender can claim to be from paypal.com while sending from a server in another country, and the average recipient sees paypal.com and trusts it.

DMARC was built to stop that specific trick. It lets domain owners publish a policy that tells receivers what to do with emails that do not come from their own mail servers. That is the entire problem it solves.

What DMARC actually verifies

DMARC does one thing: it checks whether the domain in the From header matches the domains validated by SPF and DKIM.

That check has two parts.

SPF alignment check

SPF proves that the sending server is authorized to send for a particular domain. It does this by comparing the domain in the RFC5321.MailFrom command (the envelope sender) against a list of authorized IP addresses published in DNS.

DMARC adds an alignment check on top of SPF. It asks: does the domain in the From header match the domain in the MailFrom? If SPF passes and the domains align, DMARC considers this one half of a passing result.

DKIM alignment check

DKIM proves that an email was signed by a server that holds the private key matching a public key published in DNS. The signature covers the message body and certain headers.

DMARC checks: does the domain that signed this email (the DKIM-Select header's d= value) match the domain in the From header? If it does, this is the second half of a passing DMARC result.

For DMARC to pass, at least one of these alignments must pass. Both can pass. One is sufficient.

The p= policy and what it controls

The p= tag in a DMARC record tells receivers what to do with emails that fail alignment. It has three settings:

• p=none: monitor only, take no action
• p=quarantine: treat failing mail as suspicious, deliver to spam likely
• p=reject: tell receivers to refuse the message outright

The policy controls handling, not verification. DMARC always checks. The policy determines what happens next.

What DMARC does NOT verify

This is where confusion causes real problems. DMARC cannot do any of the following:

Email content and body text

DMARC never reads the message body. It does not look at subject lines, attachments, images, or anything inside the email. The text of an email is completely invisible to DMARC.

Phishing links and malicious URLs

A URL in an email is just text as far as DMARC. If an attacker sends a perfectly aligned email from a legitimate server containing a link to a spoofed bank login page, DMARC has no mechanism to detect it. URL checking is the job of email security gateways, safe linking services, and browser-level protection.

Attachments and malware

No attachment scanning. No sandbox detonation. No virus signature matching. An email with a malicious PDF passes DMARC authentication the same way a clean newsletter does.

The real sender's identity beyond the From domain

DMARC validates the From header domain. It does not validate the display name, the Reply-To address, the sender name in the envelope, or anything in the email headers that is not the From domain. An email can pass DMARC and still be a reply-to spoofing attack or a conversation hijack.

Whether the recipient address is valid

DMARC does not check if the To: address is correct or reachable. Bounces, wrong recipient errors, and misdirected emails are entirely outside DMARC's scope.

Reply-to address mismatches

If the From header shows your domain (passing DMARC) but the Reply-To points somewhere else, DMARC says nothing about this. This is a well-known gap that phishing operators exploit. DMARC only covers the From domain.

Why DMARC passing does not mean an email is safe

The practical implication is simple: DMARC and email content security are separate layers.

A marketing platform sends email on behalf of your domain. The email passes SPF alignment because the platform's servers are authorized. It passes DKIM because the platform signs with your domain's key. DMARC passes cleanly. And yet the offer in that email was written by a third party, approved by a different team, and has never been reviewed by your IT department.

That is not a DMARC failure. That is working as designed. DMARC verifies sending authority, not content authority.

Similarly, a compromised internal account can send email that passes every DMARC check because it genuinely originates from your infrastructure with proper alignment. The account breach is not a DMARC event.

The gap DMARC cannot close is visibility: knowing which sources are actually sending for your domain, which ones are failing alignment, and whether that failure is authorized or a signal of compromise. That is what aggregate reports are for. They show the sending landscape for your domain across all receivers. Parsing those reports manually is tedious; tools that surface alignment failures and flag unauthorized sources make this operational. That is where domain monitoring fits into the security stack alongside DMARC, not as a replacement for it.

FAQ

Does passing DMARC mean an email is safe to click?

No. DMARC verifies the sending domain is authorized. It says nothing about the content of the email, the links it contains, or the intent of the sender.

Can DMARC detect spoofing?

DMARC prevents spoofing of the From header domain by unauthorized servers. It does not prevent all forms of impersonation. Reply-to spoofing, display name spoofing, and conversation hijacking are not caught by DMARC.

Can I use DMARC to block all unauthorized senders?

p=reject gets close, but only for domain spoofing. If someone sends from their own legitimate domain (not yours), DMARC is irrelevant to that message.

Does DMARC check the Reply-To address?

No. DMARC does not compare the From header domain to the Reply-To header domain. A mismatch there is a known gap.

What tools complement DMARC for content security?

Email security gateways scan URLs, attachments, and body content. Safe linking services rewrite URLs at click time. SPF and DKIM on their own (without DMARC) still leave alignment gaps. These layers work together; DMARC is not a replacement for any of them.