PCI DSS 5.4.1: prove your email is protected against phishing

Requirement 5.4.1 of PCI DSS v4.0.1, mandatory since March 31, 2025, calls for automated mechanisms that detect and protect your people against phishing. Its guidance names SPF, DKIM and DMARC as examples. Delivery Center puts all three in place, keeps watching them and gives you the evidence to show your assessor.

PCI DSS 5.4.1SPF, DKIM & DMARCSender discoveryAudit evidencePath to enforcement

The anti-spoofing controls the 5.4.1 guidance names, monitored in one dashboard.

Get Audit-Ready Check Your DMARC Record

Delivery Center comes with a 30-day money-back guarantee.

How DMARC, SPF and DKIM work with MxToolbox

What 5.4.1 says

Requirement: processes and automated mechanisms to detect and protect personnel against phishing attacks.
In force: mandatory since March 31, 2025.
Examples in the guidance: SPF, DKIM and DMARC, link scrubbing and anti-malware.
DMARC policy: not specified.

Where do you stand? Look up your DMARC record free →

What your assessor will ask

Is DMARC published, and at what policy?
Do your senders pass SPF and DKIM, aligned?
Is someone watching the reports?

Delivery Center answers all three in one dashboard.

Is DMARC required for PCI DSS?

Not by name. Requirement 5.4.1 doesn't mandate a specific technology. It requires automated anti-phishing mechanisms, and its guidance lists SPF, DKIM and DMARC as examples of controls that detect and stop spoofed mail. In practice they're the most direct way to show an assessor that your domain can't easily be used to phish your staff or customers, and you likely need them already to meet Google, Yahoo! and Microsoft sender rules.

Anti-spoofing controls

SPF, DKIM and DMARC are the controls the 5.4.1 guidance names for stopping fraudsters from sending as your domain.

Monitored, not just published

A DMARC record nobody reads is a weak control. Delivery Center processes reports from 500+ inbox providers and alerts you to failing or unknown senders.

One setup, many requirements

The same work meets the Google, Yahoo! and Microsoft sender rules, unlocks BIMI and answers cyber insurance and customer security questionnaires.

How Delivery Center maps to 5.4.1

What 5.4.1 looks for	How Delivery Center helps
Automated detection of phishing that uses your domain	DMARC aggregate (RUA) and forensic (RUF) reports show every service sending as your domain, with unknown and unauthorized senders flagged
Protection against spoofed mail	A guided move from p=none to quarantine and reject, so receiving servers block mail that fakes your domain
Valid SPF and DKIM for every legitimate sender	Pass and alignment rates by sender and DKIM selector, configuration analysis and expert recommendations, plus SPF Flattening on Plus
A process, not a one-time setup	Alerts for new or failing senders and configuration changes, with history you can show at your next assessment
Evidence for your assessor	Your published policy and your senders' SPF, DKIM and DMARC pass rates over time, in one dashboard

Delivery Center covers the email authentication side of 5.4.1. The requirement also expects other anti-phishing measures, such as link scrubbing and anti-malware, and Requirement 12.6.3.1 adds phishing awareness training. Your QSA decides what satisfies each requirement in your environment.

From compliance to enforcement

Publish and monitor

Publish DMARC at p=none and send reports to Delivery Center. That meets the inbox provider rules: the short-term goal.

Fix every sender

SPF and DKIM pass and alignment rates by sender show what to fix, from your ESP to your billing and support systems.

Enforce

Move to quarantine, then reject. Enforcement is the ultimate goal and the strongest evidence that your anti-phishing control works.

PCI DSS doesn't set a DMARC policy, but p=none only reports spoofed mail. It doesn't stop it. Enforcement is what protects your brand, your sending reputation and your business from BEC. Learn about DMARC enforcement →

Built for the way your team sends

Email Marketers

Keep receipts, statements and campaigns authenticated so compliance work never blocks your own mail, and get your logo in the inbox with BIMI once you're enforced.

DMARC Adopters

Turn the DMARC work you're already doing into PCI evidence, and move from compliance to enforcement with pass rates by sender guiding each step.

IT Email Administrators

Answer your QSA with a clear record of your policy, senders and pass rates, and get alerted when a new service starts sending as your domain.

Get Audit-Ready

What DMARC does and doesn't cover

SPF, DKIM and DMARC stop fraudsters sending mail from your exact domain. They don't stop lookalike domains or attacks from a compromised mailbox, and they don't decide what happens to the mail your staff receive. Inbound filtering, link scrubbing and phishing awareness training cover those parts of 5.4.1 and 12.6.3.1.

Still setting up DMARC? Meeting the Google, Yahoo! and Microsoft sender rules is the first milestone.

Start with DMARC Compliance →

20+ years in email deliverability

42K+Domains trust MxToolbox

500+DMARC-reporting inbox providers

114M+DMARC digests processed annually

MillionsMessages processed hourly

Part of Delivery Center

PCI DSS support is one piece of a full email reputation toolkit. Paid Delivery Center plans also include:

DMARC Compliance

Find every sender and meet Google, Yahoo! and Microsoft sender rules.

Learn more →

DMARC Enforcement

Move safely to quarantine and reject and block spoofing of your domain.

Learn more →

BIMI Adoption and Management

Put your logo next to your messages once you reach enforcement.

Learn more →

See everything in Delivery Center →

Frequently asked questions

Is p=none enough for PCI DSS?

PCI DSS doesn't set a policy, so a monitored p=none record can be a starting point. Enforcement is stronger evidence, because p=none reports spoofed mail without stopping it.

Which of our domains need DMARC?

Every domain that sends email, and parked domains that don't. A domain that never sends mail can publish an SPF record of v=spf1 -all and a DMARC policy of p=reject so no one can spoof it.

Do third-party senders count?

Yes. Your ESP, CRM, billing and support tools send as your domain, so each needs to pass SPF or DKIM with alignment. Delivery Center finds them in your DMARC reports.

Should we check DMARC on mail we receive?

Yes. 5.4.1 is about protecting your own people, so your inbound mail filter should check SPF, DKIM and DMARC too. Delivery Center covers the domains you send from.

Rather have experts handle it? MxToolbox Managed Services takes you from no DMARC to full reject enforcement for you. Learn about Managed Services → or call +1 (866) 698-6652.

Compare plans

Start free, or pick the plan that fits how you send.

	Free$0One domain, top 30 blacklistsSign Up	Delivery Center$129/monthManage your own email reputationBuy Now30-day money-back guarantee	Delivery Center Plus$399/monthHigher volume, complex sendersBuy Now	Managed ServicesCustom pricingOur experts do it for youSchedule a Consultation
Plan limits
Domains	1	5	5	Custom
Email message volume	—	500,000	5,000,000	Custom
Monitoring
Blacklist monitoring Checks your senders against public blacklists and alerts you when a new listing appears	Top 30 lists, weekly	Every sender, 100+ lists	Every sender, 100+ lists	Every sender, 100+ lists
Adaptive Blacklist Monitoring Finds every service sending as your domain, including ESPs and CRMs, from your DMARC reports and adjusts automatically when their IPs change	—	✓	✓	✓
Outbound + Inbound Mailflow Monitoring Round-trip test messages every 5 minutes, tracking queue delays and server response times, with alerts at your thresholds	—	✓	✓	✓
Inbox Placement
Inbox Placement tests Inbox, Spam/Junk or rejected at Google, Yahoo! and Outlook.com	—	30 / month	100 / month	100 / month
Email visualization Your full email rendered, with MxTips highlighting risky content	—	✓	✓	✓
Content quality analysis Wording, image counts, links and unsubscribe patterns that look like spam, with images verified and links tested before you send	—	✓	✓	✓
Email header analysis SPF, DKIM and DMARC alignment checked on every test message	—	✓	✓	✓
Bulk sender rule tests Google, Yahoo! and Microsoft requirements, updated as the rules change	—	✓	✓	✓
Domain, IP & content reputation Uncover the proprietary blocklist and reputation issues behind spam placement	—	✓	✓	✓
Recipient complaints
Google Postmaster spam rate Track your Gmail spam rate against Google's 0.1% target and 0.3% limit	—	✓	✓	✓
Feedback loops (ARF) Complaint reports from Yahoo!, Outlook.com, Mailgun and others	—	✓	✓	✓
Complaint analysis See who is complaining, clean your lists and audit campaign quality	—	✓	✓	✓
DMARC reporting
RUA aggregate reports Daily reports from Google, Outlook.com, Yahoo! and 500+ inbox providers, parsed for you	—	✓	✓	✓
Sender discovery Find the legitimate, unknown and unauthorized senders using your domain	—	✓	✓	✓
RUF forensic reports Individual messages that failed authentication, turned into actionable reports	—	✓	✓	✓
SPF & DKIM alignment tracking Pass and alignment rates by sender and DKIM selector	—	✓	✓	✓
Configuration & protection
SPF, DKIM & DMARC configuration management Expert recommendations and tools to set up SPF, DKIM and DMARC and keep them current as your senders change	—	✓	✓	✓
DMARC enforcement (Domain Impersonation Protection) Move safely from p=none to quarantine and reject to block spoofing and BEC without blocking your own mail	—	✓	✓	✓
BIMI Adoption and Management Validates your BIMI record, SVG logo and VMC or CMC certificate, and alerts you before a certificate expires	—	✓	✓	✓
SPF Flattening Keeps your SPF record under the 10-lookup limit and rebuilds it as you add senders	—	—	✓	✓
Advanced threat tools See the IP ownership, geolocation and reputation of unknown senders to trace who is spoofing your domain	—	—	✓	✓
Expert service
Onboarding support & account walkthrough	—	✓	✓	✓
Email setup assessment of every internal and 3rd-party sender	—	—	—	✓
Hands-on SPF, DKIM and DMARC implementation	—	—	—	✓
Expert analysis of your DMARC report data	—	—	—	✓
Proactive monitoring, alerts and recommendations	—	—	—	✓
Ongoing maintenance as senders and requirements change	—	—	—	✓
Team education & DMARC compliance training	—	—	—	✓
	Free$0Sign Up	Delivery Center$129/monthBuy Now	Delivery Center Plus$399/monthBuy Now	Managed ServicesCustom pricingSchedule a Consultation

Plans & pricing30-day money-back guarantee on Delivery CenterCompare all features

Free$0Sign Up

Delivery Center$129/moBuy Now

Delivery Center PlusDC Plus$399/moBuy Now

Managed ServicesManagedCustomSchedule a ConsultationContact Us

Get your email controls audit-ready

Find every sender, fix what fails and move to enforcement, with the evidence to show for it. Delivery Center comes with a 30-day money-back guarantee.

Start with Delivery Center