Does DMARC stop phishing?

DMARC stops one specific, common kind of phishing: exact-domain spoofing, where an attacker puts your real domain in the From address to make a message look like it came from you. With DMARC at p=reject, receivers refuse those forgeries. But DMARC does nothing about lookalike domains, display-name tricks, compromised accounts, or phishing sent from any domain you do not own. So the honest answer is that DMARC is necessary but not sufficient — it closes the cheapest impersonation route and leaves several others for other controls to handle.

At a glance

Quick takeaways

• DMARC stops exact-domain spoofing — forged mail claiming to come from a domain you own and enforce.
• It does not stop lookalike domains, display-name spoofing, compromised mailboxes, or mail from unrelated domains.
• DMARC only acts once your policy is at p=quarantine or p=reject; p=none monitors but blocks nothing.
• Authentication proves which domain sent a message, not whether that domain is trustworthy.
• Real phishing defense is layered: DMARC for your domain, plus lookalike monitoring, filtering, and user training.

What kind of phishing does DMARC actually stop?

DMARC stops direct forgery of a domain you control. Without it, anyone can put billing@yourcompany.com in the From header, and many receivers will deliver that message because nothing checks whether the sender is authorized. DMARC closes that gap: it requires a message to pass SPF or DKIM and for the passing identifier to align with the domain in the From header. When alignment fails and your policy is at enforcement, the receiver applies your instruction — quarantine or reject.

That covers a large slice of real-world abuse. Attackers impersonating a brand's own domain — fake invoices from accounts@yourcompany.com, fake password resets from security@yourcompany.com — are exactly what DMARC was designed to defeat. It is also why Gmail and Yahoo made DMARC a hard requirement for bulk senders in February 2024: shutting down exact-domain spoofing removes the single most convincing phishing technique.

One caveat that catches people out: DMARC only does this at enforcement. A record set to p=none collects aggregate reports but tells receivers to take no action, so spoofed mail still lands. Monitoring is a starting point, not protection.

What phishing does DMARC not stop?

Most phishing does not forge your exact domain at all, and none of these techniques touch a record you publish:

• Lookalike (cousin) domains. A message from yourcompany-support.com or yourcompаny.com (with a swapped character) comes from a domain the attacker owns. The receiver checks that domain's DMARC, not yours, so lookalike domains sail past your enforcement.
• Display-name spoofing. The visible name reads "Your Company Billing" while the real address is random123@gmail.com. DMARC validates the domain, which authenticates cleanly as Gmail — the deception lives in the display name a phone client often hides.
• Compromised accounts. If an attacker steals real credentials and sends from a genuine mailbox, the mail is authentically that domain's. It passes SPF, DKIM, and DMARC because it really did come from there.
• Unrelated domains. Plenty of phishing never mentions your brand — a fake courier notice, a fake bank alert — sent from throwaway domains with their own valid records.

In each case authentication succeeds or is simply irrelevant, because the attacker never had to forge you.

Why does authenticated phishing still land in the inbox?

Because authentication answers a narrower question than most people assume. SPF, DKIM, and DMARC together prove who sent a message — which domain is responsible for it. They say nothing about whether that domain is honest. An attacker who registers a fresh domain can publish perfectly valid SPF and DKIM and even a p=reject DMARC record on it, and their phishing then passes every authentication check — for their own domain.

This is the same scoping limit behind ghost phishing and other techniques that route around DMARC entirely. The mental shortcut "authenticated equals safe" is exactly what these attacks exploit. A green authentication result confirms provenance, not trustworthiness, and treating the two as the same thing is the gap phishers work in.

How do you close the gaps DMARC leaves?

Because no single record can cover every domain an attacker might buy or compromise, phishing defense is layered. DMARC is the foundation, not the whole structure:

• Get every domain you own to enforcement. Publish p=reject (or at least quarantine) on your primary domain and set a subdomain policy so unused subdomains are covered. This removes the easiest attack and forces adversaries onto noisier, more detectable routes. A DMARC record generator helps you build the record correctly.
• Monitor for lookalike registrations. Watch for typosquats, homoglyphs, and combosquats of your brand so you learn about secure-yourcompany.net before your customers do.
• Adopt brand indicators. With DMARC at enforcement, BIMI can show your verified logo on authenticated mail in supporting mailboxes — a positive signal a bare lookalike cannot reproduce.
• Keep inbound filtering and MFA strong. Filtering catches display-name fraud and known-bad domains; phishing-resistant MFA limits the damage when credentials are compromised.
• Train recipients to read the real address. Much of this abuse lives in a display that looks right at a glance. Teaching people to expand the actual From domain closes a gap DMARC structurally cannot.

Getting your own domains fully locked down is the layer Palisade automates: it deploys SPF, DKIM, and DMARC, moves your domains to enforcement, and reads the aggregate reports so exact-domain spoofing is closed and impersonation attempts are visible. It will not register a cousin domain for you, but it removes the easy attack and clarifies where the remaining risk sits. Start by checking your posture with the Email Security Score.

Related reading

• What is DMARC?
• Why do phishing emails pass SPF and DKIM checks?
• What does DMARC stand for? DMARC meaning in plain English