Check Your Escrow Email Domain’s DMARC Policy
Check the DMARC policy on your escrow email domain, understand its limits, and plan changes with your email administrator.
Your email domain is part of the identity clients rely on. A DMARC lookup can reveal whether it publishes a policy for messages that fail domain authentication. That is a useful check, not a test of whether a particular payment instruction is authentic.
What DMARC does
DMARC evaluates alignment between the visible From domain and an authenticated SPF or DKIM domain. The domain owner publishes a handling preference for failures. It does not simply list the servers allowed to send email, and it does not establish the identity of the person writing a message.
The current specification is IETF RFC 9989, published in May 2026, which supersedes RFC 7489. Receiving providers apply their own filtering and handling decisions. A missing record does not mean every forged message will be delivered; a reject policy does not guarantee every forgery will be blocked.
Run the lookup
Use your email provider's tools or a public DNS lookup service to check the DMARC TXT record at _dmarc.yourcompany.com. A service such as MXToolbox can make the result easier to read. Record the domain, time and result.
- No DMARC record: No DMARC policy was found at the queried location. Other filtering may still operate.
- p=none: The domain requests no DMARC-specific failure disposition. Reporting can help identify legitimate senders and authentication problems.
- p=quarantine or p=reject: The domain expresses a stronger handling preference for failures. Receiver policy still matters.
Ask the email administrator to review the whole setup
Inventory every legitimate sender, including marketing, invoicing and transaction systems. Check SPF and DKIM configuration and alignment before changing enforcement. Monitor results and resolve legitimate-mail failures before increasing the policy.
A useful request is: “Please review SPF, DKIM and DMARC for our domain, identify every legitimate sender, and recommend an enforcement and monitoring plan.” Setup time, monitoring needs and service costs vary. Do not assume every office can complete it in an afternoon or without paid support.
Keep the limits visible
DMARC does not stop a lookalike domain or a compromised legitimate mailbox. It does not confirm account ownership or approve a wire. Continue the office's independent payment-verification process and review changed instructions through established contacts.
What to save
The lookup result, administrator's findings, sender inventory, policy change and follow-up date. This is an operational snapshot. No percentage of California escrow domains can be inferred from one lookup, and this guide does not publish an auditable industry survey.
Sources
One page in the file before money moves.
Your office decides. Veto records what was reviewed, what stayed open, and who reviewed it.