DMARC (Domain-based Message Authentication, Reporting and Conformance) is a published DNS policy that sits on top of two older email authentication methods, SPF and DKIM. It tells receiving mail servers what to do when a message claiming to come from your domain fails those checks (deliver it, quarantine it to spam, or reject it), and where to send reports about the traffic they see. Its core job is to tie the authenticated domain to the visible From address so someone else cannot send mail that appears to come from you.
How it works
You add a TXT record at _dmarc.yourdomain.com with a policy tag. The common ones are p=none (monitor only), p=quarantine, and p=reject. A message passes DMARC if it passes SPF or DKIM and the domain that passed also aligns with the From address the recipient sees. The rua tag sets an address to receive daily aggregate reports, which show how much mail is passing, failing, and where it originates.
Why it matters
Without DMARC, a scammer can forge your From address and recipients have no automated way to reject it. For B2B sellers this is a real risk, since quotes, invoices, and payment links are exactly what attackers like to impersonate. A p=reject policy also protects your sending reputation, which helps legitimate quote emails reach the inbox instead of spam.
Example for Shopify quoting
If you send quotes from your own domain rather than a generic app address, you control SPF, DKIM, and DMARC for that domain. When ShopQuotes sends a Live Quote link from sales@yourbrand.com, aligned authentication means the buyer’s mail server trusts it and it lands in the inbox. See the B2B quoting glossary for related terms like SPF and DKIM, or pricing for plan details.