What does DMARC stand for?
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. An email policy published in DNS that tells receivers what to do (none, quarantine or reject) with messages that fail DMARC, meaning neither SPF nor DKIM passes in alignment with the visible From domain, and where to send reports.
DMARC builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the domain in the From address the user sees; this match is called alignment. The domain owner publishes a policy in DNS, none, quarantine or reject, telling receivers what to do with failures, and an address for reports. DMARC is defined in RFC 7489.
DMARC in practice: an example
example.com publishes v=DMARC1; p=reject at _dmarc.example.com, with a rua tag that names the mailbox for aggregate reports. A phishing message shows example.com in the From line but was sent through an unrelated server and has no valid signature. It fails DMARC and the receiver rejects it. The owner sees the attempt in the daily aggregate report.
What DMARC is confused with
DMARC vs SPF and DKIM: what is the difference?
SPF and DKIM are the checks. DMARC ties their result to the visible From domain, sets the policy on failure and adds reporting.
Which exams cover DMARC?
DMARC is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
- CySA+ CS0-004: on the acronym list, not tied to one objective.
- A+ 220-1201 and 220-1202: 220-1201 2.0 (Networking).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A domain has valid SPF and DKIM, yet spoofed messages using its name in the From line still reach inboxes. What is missing?
- A DMARC record with an enforcing policy
- A longer DKIM key
- An MX record
- Reverse DNS for the web server
Show the answer
A. A DMARC record with an enforcing policy. Without DMARC nothing requires the authenticated domain to match the visible From domain, and receivers have no instruction to reject failures.
2. An organization is deploying DMARC for the first time and wants to see who sends mail in its name without affecting delivery. Which policy should it start with?
- p=reject
- p=quarantine
- p=none with reporting
- No record at all
Show the answer
C. p=none with reporting. p=none asks receivers to send reports but take no action, so legitimate senders can be found and fixed before enforcement.
Sources: RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC); NIST SP 800-177 Rev. 1, Trustworthy Email. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.