Yes, effectively. Gmail and Yahoo require DMARC for bulk senders (≈5,000+/day), and standards like PCI DSS 4.0 and NIS2 expect anti-phishing controls that DMARC provides. Even if you’re not a bulk sender, DMARC is the only control that stops exact-domain spoofing, so it’s best practice for every domain.
Gmail/Yahoo sender rules (2024) require DMARC for bulk senders. PCI DSS 4.0 requirement 5.4.1 requires anti-phishing mechanisms. Government frameworks (NIS2 in the EU, BOD 18-01 in the US federal space) mandate DMARC at enforcement.
Without DMARC, anyone can spoof your exact domain. Enforcement (p=quarantine/reject) is what actually stops that — monitoring alone does not.
Check your DMARC record now
Open the free DMARC checker →It meets a bare minimum where only “a DMARC record” is required, but most frameworks and best practice expect enforcement to actually stop spoofing.
