Glossary: Logs and Data Sources for Investigations

DMARC

Also written: Domain-based Message Authentication, Reporting and Conformance

An email policy that uses SPF and DKIM results to check that the From domain is genuine, and tells receivers what to do with mail that fails. A pass proves only who owns the domain, so an attacker's lookalike domain can pass it.