DMARC

Also known as: Domain-based Message Authentication, Reporting & Conformance

DMARC is an email-authentication standard that tells receiving servers how to handle messages that fail SPF and DKIM checks, protecting a domain from spoofing and impersonation.

DMARC builds on SPF and DKIM. A DMARC policy of p=reject instructs mail servers to drop unauthenticated mail claiming to be from your domain — the strongest protection against exact-domain spoofing. Many organizations publish DMARC at p=none (monitor only) and never enforce, leaving the domain spoofable.

Vigil's posture assessment and free CyberScan both check SPF, DKIM, and DMARC, and flag domains that haven't moved to enforcement.