DMARC gets asked to do many jobs it was never designed for. Teams use it as spam filter, phishing filter, deurtrust signal. It is none of those. The current protocol defined in RFC 9989 answers a narrow question: did the owner of the apoptive From address authorise this message, and can that authorisation be established through an aligned SPF or DKIM result? That question matters.

SPF is a published list of servers a domain says are allowed to send mail; receivers check if the message came from one. DKIM is a cryptographic signature that confirms the mail genuinely came from the signing domain and was not tampered with. DMARC ties both back to the visible From address, the part a human actually reads and trusts, not the hidden envelope address.

DMARC passes if either SPF or DKIM aligns with the visible From domain. In relaxed mode the domains only need to share the same organisational domain; in strict mode they must be identical. A policy of p=reject asks receivers to reject failures, but the receiver retains final control and may apply local exceptions.

DMARC protects against exact‑domain spoofing and gives aggregate reports, but it does not guard against lookalike domains, display‑name impersonation, compromised mailboxes, authenticated malicious domains, spam, or forwarding failures. A pass only proves authorisation, not truthfulness or safety, so vendors claiming DMARC “stops phishing” leave customers exposed.