Business
For firms
External Exposure Check External Cybersecurity Assessment Monitoring Signed assessment record See it first How we use AI
By problem
Forged invoices Staff in breach records Email anyone can fake Look-alike domains Insurance renewal Confidentiality rules
By sector
Law firms Accounting practices Dental and health clinics Financial advisers Insurance and mortgage brokers Real estate brokerages Trades and contractors Studios and wellness Restaurants and hospitality All sectors
Individual
Free address check Personal Exposure Briefing First three steps Check my address
Partners
Partner types
IT providers Accountants and bookkeepers Insurance brokers Associations Insurers Referral partners
Programme
How it works Become a partner Partner portal
Intelligence
Learn
Articles Weekly briefing Glossary Threat patterns
Research
Research reports Disclosure tracker Rules and frameworks
Tools
Free address check Email spoofing check Verify a record
Help
Help centre Questions and answers Contact
How we work
About
About us Careers Contact
How we work
Methodology What we never do Trust centre How we use AI
Legal
Privacy Terms Refund policy
Sign in Check my firm
Glossary › Email authentication
Reference · Glossary

DMARC

Domain-based Message Authentication, Reporting, and Conformance

Definition

A published rule telling mail servers what to do with email that fails your domain’s checks.

In plain words

Without it, anyone can send email that says it is from your firm, and most inboxes will accept it.

Why it matters to a firm

Forged invoices and changed wire details usually arrive from an address that looks exactly like yours. A DMARC policy at “reject” stops forged mail in your exact name; it does not stop a lookalike domain.

How anyone can check it

nslookup -type=txt _dmarc.yourfirm.ca

If nothing comes back, there is no policy. If it says p=none, forged mail is still delivered.

See what is open from outside before anyone else does. Check my firm →