--- title: What DMARC Actually Protects You From, and What It Does Not description: DMARC checks one specific thing: whether the domain shown in an email's From line authorized the message, verified through SPF or DKIM alignment. It... canonical: https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What DMARC Actually Protects You From, and What It Does Not | daily.dev og:description: DMARC checks one specific thing: whether the domain shown in an email's From line authorized the message, verified through SPF or DKIM alignment. It... og:url: https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj og:image: https://api.daily.dev/og/posts/Tkii6cYBJ.png og:image:alt: What DMARC Actually Protects You From, and What It Does Not og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What DMARC Actually Protects You From, and What It Does Not **[Hacker News](https://daily.dev/sources/hn)** · 7 min read · 0 upvotes · 0 comments ## Summary DMARC checks one specific thing: whether the domain shown in an email's From line authorized the message, verified through SPF or DKIM alignment. It effectively blocks exact-domain spoofing and provides aggregate reports on who sends as your domain. However, it does not protect against lookalike domains, display-name impersonation, compromised mailboxes, authenticated-but-malicious senders, spam, or forwarding-induced authentication failures. A DMARC pass means authorization, not trustworthiness or safety. Reaching p=reject is a meaningful milestone but not a complete phishing defense. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 40 comments across hackernews (as of 2026-08-03). **TL;DR:** The community finds the article a thin, possibly AI-generated overview of DMARC that covers only the bare minimum; discussion quickly pivots to practical tooling (rspamd replacing opendmarc) and tangential debates about self-hosting email deliverability. **Sentiment:** 25% positive · 45% mixed · 30% skeptical **The case for** - rspamd is widely recommended as a solid, actively maintained replacement for opendmarc for inbound DMARC validation - go-msgauth (go-dkim) is noted as a good library-level option for Go developers **The pushback** - The article is suspected to be AI-generated, making its accuracy untrustworthy - It covers only the bare minimum and explains the subject in an obscure way - It conflates or glosses over the distinction between SMTP-layer (RFC 821) and message-layer (RFC 822) concepts, which is key to understanding SPF/DKIM/DMARC relationships **By community** - hackernews (mixed): Commenters are skeptical of the article's quality and AI origins, but the thread generates useful side-discussion on DMARC tooling and self-hosting challenges. **Hottest debate:** Whether the article is AI-generated and therefore unreliable versus simply being a beginner-friendly first draft worth some credit. **Open questions** - What is the current go-to open-source library/daemon for validating received mail against DMARC rules now that opendmarc is effectively abandonware? - Are Alex Shakhov's in-depth email deliverability posts accessible without a LinkedIn account? **Highlights** > Vaguely related question: what is the go-to open DMARC check implementation these days? I mean the part that checks _received_ mail against DMARC rules. It used to be opendmarc, but it seems people have been dropping it for a while because of history of breaking changes and general lack of good stewardship [1]. Anyone using pydmarc [2]? It's hard to find good info on this since 99% of search hits are people talking about setting up DMARC from the _sender_ side. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014058#39 [2] https://pypi.org/project/dmarc/ > — [avian on hackernews · 3 comments](https://news.ycombinator.com/item?id=49154034) > > Every email carries two "from" addresses I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following). It makes the link between SPF, DKIM and DMARC much clearer. Anyway. The article covers just the bare minimum, and in the most obscure way. For those interested in the inner workings of contemporary email delivery... I recommend the posts by Alex Shakhov on LinkedIn https://www.linkedin.com/in/alexshakhov/ (Yes, there is still meaningful content on LinkedIn, it's just vanishingly rare) > — [sam\_lowry\_ on hackernews · 3 comments](https://news.ycombinator.com/item?id=49153709) > > Here is the part that trips people up. It's hard to take something seriously when it's very clearly AI generated. It's just a coin toss on whether the information in the article is correct. > — [joladev on hackernews · 1 comments](https://news.ycombinator.com/item?id=49154535) > I use rspamd. This might be a little heavy if you’re solely looking for DMARC validation, but I use the other parts of rspamd as well for inbound email. https://rspamd.com/modules/dmarc/ For a library, I mainly write Go and I use https://github.com/emersion/go-msgauth (formerly known as go-dkim). > — [oogali on hackernews · 1 comments](https://news.ycombinator.com/item?id=49154539) > I can't share all of it, but to understand the relationship between SPF, DKIM and DMARC one should know that DMARC covers two possible cases. Either DKIM domain must match From: domain or MAIL FROM domain must match the From: domain plus the IP address of the sender should pass the SPF check https://mikhailian.mova.org/delivering-mails/1.png shows the SMTP plaintext chat for the first case, https://mikhailian.mova.org/delivering-mails/2.png shows the second. > — [sam\_lowry\_ on hackernews](https://news.ycombinator.com/item?id=49157402) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49153361) · 45 points · 40 comments ## Similar posts on daily.dev - [SPF, DKIM, and DMARC explained for developers](https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg) · Flavio Copes · 2 upvotes · 1 comments - [SPF Alignment: Why is it Important for Improving DMARC](https://daily.dev/posts/spf-alignment-why-is-it-important-for-improving-dmarc-voyvelyv6) · Security Boulevard · 0 upvotes · 0 comments - [DMARC Has Been Public Since 2012. 68.4% of Company Domains Still Don't Enforce It.](https://daily.dev/posts/dmarc-has-been-public-since-2012-68-4-of-company-domains-still-don-t-enforce-it--fqi9oizmo) · Hacker News · 0 upvotes · 0 comments - [DMARC reports are the only outside view of your mail](https://daily.dev/posts/dmarc-reports-are-the-only-outside-view-of-your-mail-bzxwpayb1) · /dev/io · 0 upvotes · 0 comments - [Cloudflare DMARC Management is now generally available](https://daily.dev/posts/cloudflare-dmarc-management-is-now-generally-available-iafjsukql) · Cloudflare · 7 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What DMARC Actually Protects You From, and What It Does Not","url":"https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj"},"datePublished":"2026-08-03T12:15:30.902Z","dateModified":"2026-08-03T18:45:01.725Z","description":"DMARC checks one specific thing: whether the domain shown in an email's From line authorized the message, verified through SPF or DKIM alignment. It...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-dmarc-actually-protects-you-from-and-what-it-does-not-tkii6cybj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"What DMARC Actually Protects You From, and What It Does Not"}]} ```