PCI DSS 4.0 and DMARC: Why Email Security is Now a Compliance Requirement

As of March 31, 2025, the Payment Card Industry Data Security Standard (PCI DSS) version 4.0 mandates the implementation of Domain-based Message Authentication, Reporting, and Conformance (DMARC) for all entities involved in processing, storing, or transmitting cardholder data.

This requirement aims to enhance email security by preventing domain spoofing and phishing attacks, thereby safeguarding sensitive payment information.​

What Is DMARC?

DMARC is an email authentication protocol that builds upon existing standards like SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). It enables domain owners to specify policies for handling unauthenticated emails, providing mechanisms for reporting and improving visibility into email ecosystems.

By implementing DMARC, organisations can protect their domains from unauthorised use, reducing the risk of phishing and email fraud.​

Implications of the PCI DSS DMARC Mandate

The inclusion of DMARC in PCI DSS v4.0 reflects the industry’s commitment to combating sophisticated cyber threats targeting email communications.

Non-compliance with this mandate can result in significant penalties, ranging from $5,000 to $100,000 per month, depending on the severity and duration of the violation.

Beyond financial repercussions, organisations may face increased vulnerability to email-based attacks, leading to potential data breaches and loss of customer trust.​

Steps to Achieve Compliance

To comply with the upcoming DMARC requirements, organisations should:

1. Assess Current Email Security Posture: Evaluate existing email authentication mechanisms and identify gaps in SPF and DKIM configurations.​
2. Implement SPF and DKIM: Ensure that SPF and DKIM are correctly set up for all domains to authenticate legitimate emails.​
3. Deploy DMARC: Publish a DMARC record in DNS with a policy aligned to the organisation’s risk tolerance (e.g., ‘none’, ‘quarantine’, ‘reject’).​
4. Monitor and Analyse Reports: Utilise  forensic reports to gain insights into email traffic and detect unauthorised use.
5. Adjust Policies as Needed: Gradually move towards a stricter DMARC policy (e.g., from ‘none’ to ‘reject’) based on the analysis of reports and organizational readiness.​

By proactively implementing DMARC, organizations not only comply with PCI DSS v4.0 but also strengthen their defences against email-based threats, thereby protecting both their brand reputation and their customers’ sensitive information.

Need assistance with DMARC changes? Speak to ToraGuard for assistance with this and wider PCI DSS security requirements