Cloud
DMARC is a DNS record that tells receiving mail systems what to do when a message fails the domain’s SPF or DKIM check, and where to send reports. It reduces spoofing of the visible domain. It does not stop a stolen mailbox password. Novatelia places the records on the domain and DNS service and the mailbox design on business email. No partner status is claimed.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- DMARC without SPF and DKIM alignment does little.
- Start with reporting before a reject policy.
- A DNS change is not a mailbox migration.
Definition
Domain-based message authentication, reporting, and conformance publishes the domain owner’s preference: monitor, quarantine, or reject messages that fail alignment. Receivers may still apply their own judgment.
How it works
SPF lists permitted sending hosts. DKIM signs the message. DMARC requires alignment with the visible From domain and asks for reports. Moving to reject is a later change, after legitimate senders appear in the reports.
Architecture
- An inventory of systems that send as the domain.
- SPF and DKIM that match those systems.
- A DMARC record, initially for reports, then a stricter policy when the reports are clean.
Use cases
- Customers receive mail that pretends to be the company’s domain.
- A new application sends mail and must be added before a reject policy.
- A tenant move is underway and both old and new senders must stay aligned.
Selection guidance
- List every sender before publishing a reject policy.
- Keep mailbox administration on the business-email page.
- Use the domain and DNS service for the records themselves.
Questions
Does DMARC encrypt email?
No. It is an authentication and policy record in DNS. Encryption in transit is a separate mail-server setting. Neither one recovers a mailbox that has already been signed into.
Who publishes the record?
Whoever controls the DNS zone. The domain and DNS service can administer a zone the customer holds. Novatelia is not a registrar by that statement.
Related
More in Cloud
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.