PCI DSS 4.0 requirement 5.4.1 mandates processes and automated mechanisms to detect and protect personnel against phishing — and DMARC is the primary technical control. In practice that means deploying SPF, DKIM and DMARC at enforcement, with reporting you can show an assessor.
Anti-phishing mechanisms protecting staff from spoofed email. DMARC at p=quarantine or p=reject stops exact-domain spoofing of your own domains — the exact threat the requirement targets — backed by SPF and DKIM alignment.
Keep evidence: your published DMARC records, enforcement policy, aggregate-report coverage showing legitimate senders aligned, and the date you reached enforcement. Automated platforms generate this audit trail for you.
Check your Pcidss record now
Open the free Pcidss checker →Requirement 5.4.1 (effective under 4.0) requires anti-phishing controls; DMARC is the recognized technical mechanism, which effectively makes enforced DMARC necessary for compliance.
