Two of these four never say the word DMARC.
The mailbox providers require the protocol by name, and cyber insurers ask for it by name on the application. PCI DSS 5.4.1 and NIS2 Article 21 do neither — they require an outcome and leave the mechanism to you, with DMARC named only in guidance. Anyone selling you “PCI DMARC compliance” is filling that gap with their own language. Here is what each text says.
Four questions instead of four pages.
Tick what is true of your organization. Most companies match two — and the answer that matters is which of them names DMARC and which only recommends it.
Tick what is true of you.
Nothing is selected yet. Most organizations match two of the four — and the two are rarely the ones they expected.
Check what an assessor would seeThe distinction every other vendor blurs.
PCI DSS and NIS2 require an outcome and leave the mechanism to you; guidance documents then name DMARC as an example control. The mailbox providers require the protocol itself, and insurers ask about it directly. That difference decides what you can accurately claim in an assessment.
Every fact in this cluster is verified against the primary sources cited on each page, last checked July 13, 2026.
What each one says.
No — the requirement never says DMARC.
Yes — DMARC is named, and required.
Yes — by name, on the application form.
No — Article 21 never says DMARC.
Every one of these starts with the same scan.
Whichever of the four you are answering to, the first question is the same: what do your records say right now, and what would an assessor see if they looked today?