Wire fraud arrives four different ways. DMARC stops one of them.
Any vendor telling you DMARC stops business email compromise is either simplifying or selling. It closes exact-domain spoofing completely — and that is worth doing first, because it is the only one you can close with a DNS record. Here is the map of the other three and what each needs.
What the fraudulent email looks like.
Pick a variant to see the header your gateway sees, whether DMARC stops it, and what closes the gap if it does not.
Exact-domain spoofing
DMARC stops thisThe attacker puts your real domain in the From header. Historically the most effective variant, because the address is yours and every visual check a recipient performs passes.
At p=reject this message is refused before delivery, at every major receiver, with no action required from the recipient. This is the variant a DNS record closes.
Nothing — this one is fully in scope. It is also the reason to get to enforcement before spending budget on anything else.
Business email compromise is the most consistent loss category in cybercrime.
Four frameworks, and the artifact each one wants.
Your compliance program is yours; a vendor supplies inputs to it. “Aligned” below is our self-assessment that a control maps to the framework — not an audit finding. “Not assessed” means scoping is your QSA’s or external auditor’s determination, not ours. Expand a row for the control we implement and the specific document you can put in an examination binder.
Whether DDMARC is a system relevant to financial reporting is your external auditor's scoping determination, not ours. If they scope it in, the controls an ITGC reviewer tests here are access, change and monitoring: every configuration and policy change is logged with actor, timestamp and source address; the admin, member and viewer roles enforce least privilege; and reports are write-once after ingestion so historical evidence cannot be edited retrospectively.
DDMARC holds no cardholder data and, in our experience, sits outside the cardholder data environment; your QSA makes that determination, not us. Encryption is AES-256-GCM at rest and TLS 1.3 in transit, with keys in AWS KMS hardware security modules (FIPS 140-validated). Every account is an individual named login — there are no shared credentials — and passkeys are supported. This is a control-alignment story, not a cardholder data story.
The Safeguards Rule expects a documented program with risk assessment, access controls and vendor oversight. The domain inventory and posture history are a direct input: a dated list of every domain able to send as your institution, which unauthorized senders were observed, and what was done about each.
Examiners increasingly ask specifically about email authentication posture and about how you monitor for impersonation of the institution. Aggregate report analysis, enforcement status per domain and lookalike observations map directly onto those questions.
Scoping, early: DMARC report data contains no cardholder data and no account numbers — it is domains, IP addresses and counts. In our experience DDMARC sits outside the cardholder data environment; your QSA makes the scoping determination, and this is usually a short conversation, not a long one.
You have trained your customers to distrust you.
Every “we will never email you a link” notice is an admission that your real mail is indistinguishable from a forgery. Authenticating these five message types in this order reverses that.
Wire and payment confirmations
The highest-value forgery you send. A confirmation that appears to come from your treasury team carries authority no other message has.
Often sent from a payments platform on a subdomain nobody added to SPF, so it fails alignment and cannot be enforced until fixed.
Transaction and fraud alerts
High volume, urgent by design, and the message customers are conditioned to act on within seconds.
Usually a third-party notification service. Getting DKIM signing on your own domain instead of theirs is the work.
Statements and trade confirmations
Contain account references, which makes a forgery instantly plausible and a phishing link instantly clickable.
Frequently a document delivery vendor with its own sending domain — visible in reports as an unknown sender until you align it.
Advisor and relationship-manager mail
Sent by individuals, often from a client-facing subdomain, and the most personal trust relationship you have.
Subdomains inherit your policy only if sp= is set. Many institutions enforce the parent and leave subdomains open.
Onboarding and KYC requests
Legitimately asks for identity documents, so a forgery asking for the same thing does not look unusual at all.
Marketing and onboarding tools are added by business teams without telling security, which is exactly what report monitoring surfaces.
What we hand you before contract.
Built for an environment with an auditor in it.
Two things to know before you write the requirements: SAML single sign-on is provisioned on Enterprise agreements only, not on self-serve plans, and team access is organization-wide, not scoped per domain. Separate organizations are the workaround for the second.
Or have the work done for you.
Both are priced on the pricing page and scoped in writing before anything is billed.
A specialist owns your authentication, not a ticket queue.
From p=none to p=reject, done with you, not explained to you.
Close the one you can close with a DNS record.
Exact-domain spoofing of your institution is solvable this quarter. Start with the domain inventory — including the lookalikes already registered against your brand. Need p=reject this quarter? The Enforcement sprint takes a domain from none to reject in about 30 days for $2,500, one-time.
What buyers on this page ask.
Financial brands are heavily impersonated in phishing. DMARC at enforcement blocks spoofing of your domain in customer communications, and BIMI displays your verified logo in the inbox to reinforce trust.
Encryption at rest and in transit, multi-tenant isolation, role-based access control, and an activity audit log on every plan. Infrastructure runs on PlatOps Security's SOC 2 Type II + ISO 27001-certified controls.
Yes. The policy impact simulator and aggregate-report insight let you identify every legitimate sender before tightening policy, and ARC chain monitoring preserves authentication through forwarders.
Yes. DDMARC publishes flat per-domain pricing across every plan — no quote-only gating — so finance teams can budget DMARC monitoring with certainty.
Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.