Glossary
DMARC
The record that tells receiving servers what to do when mail fails your checks.
What it means
DMARC sits on top of SPF and tells receiving servers what to do with mail that fails: let it through, put it in spam, or reject it. It also asks them to send you reports, so you find out who is sending mail as you.
Publishing SPF without DMARC is like writing a rule with no consequence. Many receivers will be lenient, and some large providers now expect DMARC before they will treat your mail as legitimate at all.
Start at none with a reporting address, read what comes back for a couple of weeks, then move to quarantine and then reject once you know every legitimate sender. A check reads the record from DNS and reports what is published, including the policy you chose.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026