# Does DMARC stop phishing?

> DMARC stops one kind of phishing — exact-domain spoofing of your own domain. It does not stop lookalikes, display-name fraud, or compromised accounts.

DMARC stops one specific, common kind of phishing: exact-domain spoofing, where an attacker puts *your* real domain in the From address to make a message look like it came from you. With DMARC at `p=reject`, receivers refuse those forgeries. But DMARC does nothing about lookalike domains, display-name tricks, compromised accounts, or phishing sent from any domain you do not own. So the honest answer is that DMARC is necessary but not sufficient — it closes the cheapest impersonation route and leaves several others for other controls to handle.

## Quick takeaways

- DMARC stops **exact-domain spoofing** — forged mail claiming to come from a domain you own and enforce.
- It does **not** stop lookalike domains, display-name spoofing, compromised mailboxes, or mail from unrelated domains.
- DMARC only acts once your policy is at `p=quarantine` or `p=reject`; `p=none` monitors but blocks nothing.
- Authentication proves *which domain sent a message*, not *whether that domain is trustworthy*.
- Real phishing defense is layered: DMARC for your domain, plus lookalike monitoring, filtering, and user training.

## What kind of phishing does DMARC actually stop?

DMARC stops direct forgery of a domain you control. Without it, anyone can put `billing@yourcompany.com` in the From header, and many receivers will deliver that message because nothing checks whether the sender is authorized. [DMARC](/learning/what-is-dmarc) closes that gap: it requires a message to pass SPF or DKIM *and* for the passing identifier to align with the domain in the From header. When alignment fails and your policy is at enforcement, the receiver applies your instruction — quarantine or reject.

That covers a large slice of real-world abuse. Attackers impersonating a brand's own domain — fake invoices from `accounts@yourcompany.com`, fake password resets from `security@yourcompany.com` — are exactly what DMARC was designed to defeat. It is also why Gmail and Yahoo made DMARC a hard requirement for bulk senders in February 2024: shutting down exact-domain spoofing removes the single most convincing phishing technique.

One caveat that catches people out: DMARC only does this at enforcement. A record set to `p=none` collects [aggregate reports](/tools/dmarc-report-analyzer) but tells receivers to take no action, so spoofed mail still lands. Monitoring is a starting point, not protection.

## What phishing does DMARC not stop?

Most phishing does not forge your exact domain at all, and none of these techniques touch a record you publish:

- **Lookalike (cousin) domains.** A message from `yourcompany-support.com` or `yourcompаny.com` (with a swapped character) comes from a domain the attacker owns. The receiver checks *that* domain's DMARC, not yours, so [lookalike domains sail past your enforcement](/learning/how-do-lookalike-domains-bypass-dmarc).
- **Display-name spoofing.** The visible name reads "Your Company Billing" while the real address is `random123@gmail.com`. DMARC validates the domain, which authenticates cleanly as Gmail — the deception lives in the display name a phone client often hides.
- **Compromised accounts.** If an attacker steals real credentials and sends from a genuine mailbox, the mail is authentically that domain's. It passes SPF, DKIM, and DMARC because it really did come from there.
- **Unrelated domains.** Plenty of phishing never mentions your brand — a fake courier notice, a fake bank alert — sent from throwaway domains with their own valid records.

In each case authentication succeeds or is simply irrelevant, because the attacker never had to forge you.

## Why does authenticated phishing still land in the inbox?

Because authentication answers a narrower question than most people assume. SPF, DKIM, and DMARC together prove *who sent a message* — which domain is responsible for it. They say nothing about whether that domain is honest. An attacker who registers a fresh domain can publish perfectly valid SPF and DKIM and even a `p=reject` DMARC record on it, and their phishing then [passes every authentication check](/learning/why-do-phishing-emails-pass-spf-and-dkim) — for their own domain.

This is the same scoping limit behind [ghost phishing and other techniques](/learning/what-is-ghost-phishing) that route around DMARC entirely. The mental shortcut "authenticated equals safe" is exactly what these attacks exploit. A green authentication result confirms provenance, not trustworthiness, and treating the two as the same thing is the gap phishers work in.

## How do you close the gaps DMARC leaves?

Because no single record can cover every domain an attacker might buy or compromise, phishing defense is layered. DMARC is the foundation, not the whole structure:

- **Get every domain you own to enforcement.** Publish `p=reject` (or at least `quarantine`) on your primary domain and set a subdomain policy so unused subdomains are covered. This removes the easiest attack and forces adversaries onto noisier, more detectable routes. A [DMARC record generator](/tools/dmarc-generator) helps you build the record correctly.
- **Monitor for lookalike registrations.** Watch for typosquats, homoglyphs, and combosquats of your brand so you learn about `secure-yourcompany.net` before your customers do.
- **Adopt brand indicators.** With DMARC at enforcement, [BIMI](/learning/what-is-bimi) can show your verified logo on authenticated mail in supporting mailboxes — a positive signal a bare lookalike cannot reproduce.
- **Keep inbound filtering and MFA strong.** Filtering catches display-name fraud and known-bad domains; phishing-resistant MFA limits the damage when credentials are [compromised](/learning/what-is-the-complete-guide-to-business-email-compromise-bec-attacks-in-2025).
- **Train recipients to read the real address.** Much of this abuse lives in a display that looks right at a glance. Teaching people to expand the actual From domain closes a gap DMARC structurally cannot.

Getting your own domains fully locked down is the layer Palisade automates: it deploys SPF, DKIM, and DMARC, moves your domains to enforcement, and reads the aggregate reports so exact-domain [spoofing](/learning/what-is-spoofing) is closed and impersonation attempts are visible. It will not register a cousin domain for you, but it removes the easy attack and clarifies where the remaining risk sits. Start by checking your posture with the [Email Security Score](/tools/email-security-score).

## Frequently asked questions

### If DMARC does not stop all phishing, is it still worth deploying?

Yes. DMARC closes the cheapest, most convincing attack — impersonating your exact domain — and it is a hard requirement for bulk senders to Gmail and Yahoo. Removing the easy path is the single highest-value email-security change most organizations can make.

### Does DMARC stop phishing sent *to* my employees?

Only when the phishing forges a domain you own and enforce. Mail from lookalikes, unrelated domains, or compromised third parties is unaffected by your DMARC policy; inbound filtering and user awareness handle those.

### Will `p=none` stop any phishing?

No. `p=none` is monitor-only. Receivers report on failures but take no action, so spoofed mail still reaches inboxes. Protection begins at `p=quarantine` and `p=reject`.

### Does DMARC protect against phishing on other channels, like SMS or voice?

No. DMARC governs email authentication only. Smishing (SMS) and vishing (voice) are outside its scope entirely and need their own controls.

## Related reading

- [What is DMARC?](/learning/what-is-dmarc)
- [Why do phishing emails pass SPF and DKIM checks?](/learning/why-do-phishing-emails-pass-spf-and-dkim)
- [What does DMARC stand for? DMARC meaning in plain English](/learning/what-does-dmarc-stand-for)