NexusSec.The problem: anyone can claim to be you
Email was designed without authentication. By default, nothing prevents an attacker sending a message with a "From" address of accounts@yourcompany.com. That is the mechanism behind most business email compromise: an invoice that appears to come from your finance team, or an urgent request that appears to come from your director.
Without DMARC, you have no control over this and no visibility into it.
The three standards, in order
SPF — who is allowed to send
A DNS record listing the mail servers permitted to send email for your domain. The receiving server checks whether the sending server is on that list. Its weakness: SPF validates the technical envelope sender, not the "From" address a human sees.
DKIM — proof the message is genuine and unmodified
Your mail server adds a cryptographic signature to outgoing messages, using a private key. The matching public key is published in DNS. The recipient verifies the signature, confirming the message genuinely came from your domain and was not altered in transit.
DMARC — the policy and the reporting
DMARC ties the two together and adds the two things that were missing:
- Alignment — it requires that the domain in the visible "From" address matches the domain validated by SPF or DKIM, closing the gap those standards leave open.
- Policy — you instruct receivers what to do with failures:
none(monitor only),quarantine(treat as spam), orreject(refuse delivery). - Reporting — receivers send you aggregate reports showing every source sending mail as your domain, including ones you did not know about.
How to roll it out safely
p=reject immediately. If SPF and DKIM are not fully correct for every legitimate sender — your mail platform, CRM, invoicing tool, marketing service — that mail silently stops being delivered. Always stage the rollout.- Inventory every system that sends mail as your domain. Most organisations discover senders they had forgotten.
- Publish SPF, listing all legitimate senders in a single record.
- Enable DKIM at your mail provider and publish the key it generates.
- Publish DMARC at
p=nonewith a reporting address. This changes nothing about delivery but starts the reports flowing. - Review reports for two to four weeks. Fix any legitimate sender that is failing.
- Move to
p=quarantine, monitor again, then finallyp=reject.
Why it is worth doing
- Protects your brand — criminals cannot convincingly impersonate your domain to your customers.
- Reduces BEC risk — internal spoofing of executives and finance staff is blocked.
- Improves deliverability — authenticated domains are trusted more by major providers, and some now require authentication for bulk senders.
- Gives visibility — reports reveal shadow IT and unauthorised senders using your domain.
What DMARC does not do
DMARC protects your domain from being impersonated. It does not stop inbound phishing from lookalike domains such as yourc0mpany.com, and it does not protect against a genuinely compromised mailbox — mail from a hijacked account passes authentication because it really is your account. You still need email filtering, MFA on mailboxes, and user awareness.
The bottom line
DMARC, with SPF and DKIM, is one of the highest-value, lowest-cost security controls available: it is DNS configuration, not a product purchase. Roll it out in stages, monitor the reports, and reach p=reject — but never start there.