DMARC Domain-based Message Authentication

A TXT record under _dmarc.example.com telling the recipient what to do when SPF or DKIM do not add up. Three levels: p=none just report, p=quarantine into the spam folder, p=reject turn away.

DMARC also checks whether the sender address shown in the mailbox matches the domain that was checked. Only that makes forging an address genuinely hard.

The usual route starts at p=none with a reporting address. Over two to four weeks the reports show which servers actually send in your name. After that you can raise it without risk.