--- schema_version: "1" id: 024528d7f1e9668b0551c1d07c77c5fe6a8bf13d5a36347c33d7c2fc5ae08f36 title: Domain-based Message Authentication, Reporting, and Conformance (DMARC) collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/emailadmin_dmarc.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_dmarc.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: b22426613b8ccdde33a782d6be1ae72c6656acda43f64c34ca339d6b9aa8a201 description: Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication, policy, and reporting protocol. It’s built on top of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) protocols. If neither of those authentication methods passes, the DMARC policy determines what to do with the message. Salesforce supports and recommends DMARC. It’s up to you to determine whether you implement it for your domain. products: - Security release: "264" --- # Domain-based Message Authentication, Reporting, and Conformance (DMARC) Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication, policy, and reporting protocol. It’s built on top of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) protocols. If neither of those authentication methods passes, the DMARC policy determines what to do with the message. Salesforce supports and recommends DMARC. It’s up to you to determine whether you implement it for your domain.
Available in: Salesforce Classic and Lightning Experience
Available in: all editions except Database.com
DKIM and SPF help recipients to verify the authenticity of email messages. But many email environments are complex, sending email from many different systems, including third-party providers. Also, systems and third-party providers can change over time. This complexity and variability can make authenticating every legitimate email message through DKIM or SPF challenging. For example, what if a domain owner sends emails that can’t be authenticated along with others that can? Do you reject all of them in case some are fraudulent? Or, do you accept them all and risk letting spam through to your users? That’s where DMARC comes in. DMARC is a second layer of authentication after DKIM and SPF. If an email doesn't pass DKIM and SPF authentication, DMARC policy tells the receiver what to do with the message. For example, it can reject some email messages and quarantine others. DMARC also helps senders and receivers collaborate to improve the sender’s email authentication methods and the receiver’s identification of unauthorized messages. With DMARC, the receiver can report back to the sender when emails fail their DKIM and SPF checks, even if the messages aren’t rejected. This information helps senders determine how many legitimate messages can’t be authenticated. Senders can then work with receivers to authenticate similar messages in the future. These reports can also inform senders of the scope of fraudulent emails spoofing their domain. Senders and receivers can then change their joint approach to handling emails from that domain based on this information. Salesforce supports and recommends DMARC. It’s up to you whether you implement it for your domain. #### See Also - [Email Security Mechanisms](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_security_mechanisms.htm&release=264.0.0&type=5 "Salesforce supports several email security mechanisms: Transaction Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Each mechanism protects different aspects of an email message.") - [DMARC.org](https://dmarc.org/)