Email · appears in CAIQ, SIG, SOC 2
Does your domain enforce DMARC with a quarantine or reject policy?
DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- DMARC is published and enforcing (p=quarantine or p=reject)
- Partial
- DMARC is published but not at full enforcement
- No
- DMARC is not enforcing on this domain
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.7 | DMARC enforces SPF/DKIM alignment and provides reject policy for spoofed mail. |
| ISO 27001 | A.5.14 | Information transfer policies — authenticated email channels. |
| NIST 800-53 | SC-8 | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
DMARC policy weakened from reject/quarantine to none, or removed.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.