Glossary
What Is DMARC?
Published Last updated
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with a message that claims to come from a domain but fails SPF and DKIM checks: deliver it, quarantine it or reject it. It also names where receivers should send reports about mail sent in the domain's name.
How Whisper models it
The rua= reporting address in a domain’s DMARC record becomes an edge, so you can see who collects its reports and which domains report to the same place.
MATCH (h:HOSTNAME {name:"paypal.com"})-[:DMARC_REPORTS_TO]->(r:DMARC_RECIPIENT) RETURN r.name LIMIT 10How DMARC works
A domain publishes its policy as a TXT record at _dmarc followed by the domain name. The p= tag sets the policy (none, quarantine or reject), and the rua= tag lists the addresses that should receive daily aggregate reports. A message passes DMARC when it passes SPF or DKIM and the domain that passed matches the one in the visible From header. That alignment check stops a sender from passing SPF for its own domain while displaying someone else's. Receivers that honour the record send aggregate reports, usually once a day, as compressed XML, listing each sending IP, the volume of mail from it and whether it passed.
Why it matters for infrastructure analysis
DMARC is the control that makes exact-domain spoofing fail at the receiver, so a missing record is a finding in any email posture review. A policy of none only monitors; it blocks nothing. The reports matter too. Aggregate reports list every server sending mail as the domain, which is how an owner discovers a forgotten marketing platform or an attacker using its name.
The rua= destination is evidence in its own right. It shows which DMARC processing service a company uses, and a reporting address at a domain the company no longer controls means someone else may be reading its mail-flow reports.
How it appears in the graph
WhisperGraph models the reporting side as an edge: DMARC_REPORTS_TO runs from a domain's HOSTNAME node to a DMARC_RECIPIENT node for each rua= address. Beside it sit the six SPF edges, which map every sender the domain authorizes, and DKIM_SIGNED_BY, which points to the mail vendor whose key signs its outbound mail. One anchored query returns all three for a domain, and a reverse hop from a recipient lists the other domains that report to the same place.
An empty result means no reporting address is recorded for the domain. Confirm with a direct DNS lookup before writing it up as DMARC not deployed.
Where this shows up
See it in a live investigation: DNS & email security.
Go hands-on with the DNS and email posture recipes.
