Circuit Demarcation Explained: Where the Carrier EndsA circuit's demarcation point, or demarc, is the line where the carrier's responsibility stops and yours starts. Everything on the carrier side is theirs to fix. Everything past it, including the cable run to your equipment room, is yours. That line decides who dispatches a technician, who pays for the repair, and how long an outage lasts. If you run one site, you can get by with a rough idea of where it is. If you run 40 sites, you need to know it exactly, for every circuit.

TL;DR

The demarc is the physical or logical boundary between the carrier's network and your inside wiring and equipment. It is a liability boundary as much as a technical one.
On legacy voice it is often a punch-down block. On T1s it is typically a smart jack. On modern fiber it is usually an Ethernet handoff port on a carrier-provided device.
In multi-tenant buildings the demarc is often at the minimum point of entry (MPOE), and it may have been extended deeper into the building.
Most "the carrier says it's fine" disputes come from the stretch between the demarc and your gear. Test to the demarc first.
Keep a central circuit registry: site, carrier, circuit ID, demarc location, interface type, and a photo.

What a demarcation point is
What a demarc looks like
Where the demarc sits in a building
Why the demarc decides who fixes what
Document the demarc at every site
Demarcation and common upgrades
Our perspective: treat the demarc as a design decision
How we help multi-site teams
FAQ
Sources

What a demarcation point is

The term comes from telephony. The demarcation point is where the public switched telephone network ends and connects to the customer's on-premises wiring, and it determines who is responsible for installation and maintenance on each side. Before U.S. deregulation, telephone companies owned the local loop and the wiring and equipment inside customer premises. After deregulation, the customer took over the inside wiring, and the demarc became the formal handover.

The FCC defines this boundary in its rules. 47 CFR 68.105 covers the minimum point of entry and the demarcation point. For single-unit installations, the demarc is typically within 12 inches of the protector or where the service wire enters the building.

The practical point is simple. The demarc is a business and liability boundary. If a fault sits on the provider's side, the provider repairs it at its own cost. If it sits on your side, you carry the cost and the delay. That is why labeling and documentation matter so much in enterprise operations.

Provider and customer repair responsibilities at demarc

What a demarc looks like

The answer depends on the service. People searching for this often expect a gray box on an outside wall, and sometimes that is right. On modern circuits it is often something much less obvious.

Service type	Typical demarc	What you can do there
Legacy analog voice (POTS)	Punch-down block, such as a 66-block, or another insulation displacement connection (IDC) block	Disconnect inside wiring and test the line with a handset
T1 / PRI	Smart jack	Carrier can loop the circuit back remotely and test to your door
Fiber or broadband	Ethernet handoff port on a carrier-provided router, switch, or ONT (optical network terminal)	Plug in your firewall or edge router; the port is the boundary

These hardware types follow the Cisco networking course material on demarcation points: 66-blocks and similar for legacy copper, smart jacks for T1s that allow loopback testing, and Ethernet handoffs for modern services.

The demarc is also not always a box on a wall. On a managed fiber circuit it is often a logical or physical interface, such as one specific port on a provider-managed device. That is why you need to know the exact interface type, fiber or copper RJ45, before install day. It tells you which cabling, optics, and patch panel ports to have ready.

Smart jacks and loopback testing

A smart jack is a small carrier-owned device at the end of a T1 or similar circuit. The carrier can put it in loopback from their side and prove the circuit works up to that point. A loopback plug lets the carrier test through the smart jack. If the carrier's loopback is clean and your gear still sees nothing, you know the problem is on your side. That one fact can save hours of finger-pointing.

Where the demarc sits in a building

In a house or a small office the demarc is near where the line enters. In larger commercial buildings it gets more complicated.

The minimum point of entry (MPOE)

The MPOE is the closest practical point to where facilities cross the property line or enter the building. In multi-tenant and large commercial premises the demarc can sit there. Under the FCC rule cited above, a premises owner can ask the provider to move the demarc to the MPOE, and the provider must negotiate in good faith, generally within 45 days. That matters if you own or manage a building and want one clean entry point instead of several carriers' equipment scattered around.

Extended demarcs

Engineers get caught out by assuming the demarc is at the MPOE when it is not. In a large campus or office tower, a carrier may have extended the demarc to a meet-me room or an intermediate distribution frame (IDF) on a floor. A demarc extension is the transmission path from the carrier's interface to where your equipment actually sits. BICSI's guidance on entrance rooms notes that this space can hold both access provider and customer-owned cabling and hardware.

An extended demarc adds points of failure. The cable between the building entrance and your floor may not be managed by the carrier, so a performance problem can live there while the carrier's tests pass. Always ask: is this service handed off at the true MPOE, or at an extended demarc?

Where it should live

BICSI guidance for data centers and large sites says the demarc area should be a dedicated, secured telecommunications room, either an MDF or an IDF. It should be environmentally controlled, free of moisture and janitorial equipment, and restricted by access control. A demarc in a utility closet that shares space with mops and a water heater is a future outage.

Secured equipment racks inside an MDF room

When you upgrade a site, the old demarc hardware, routers, and switches often come out. Handle that retirement properly: a network equipment disposal guide for IT managers covers secure data destruction and compliant disposal of gear that has held configuration data. Carrier-owned devices such as smart jacks or ONTs go back to the carrier. Do not recycle them yourself.

Why the demarc decides who fixes what

Here is a typical failure. An internet circuit goes down at a branch. You call the carrier. They test to the demarc, find it clean, and close the ticket. The site is still down, because the fault is in the cable between the demarc and your firewall. That stretch is yours.

A short checklist cuts this short:

Find the demarc and photograph it. Label it with the carrier name and circuit ID.
Test at the demarc. Plug a laptop or tester directly into the handoff port. If the link and the IP work there, the carrier side is healthy.
Work inward. Check the patch cable, the wall jack or fiber run, the patch panel, and then your edge device.
Escalate with evidence. If the demarc test fails, give the carrier the circuit ID, the time of the test, and the result.
Log it. Record what you found in the circuit registry.

If you want an inside-wiring contractor, make sure they know where your demarc is before they quote. Many extension jobs are a short run, but they are your cost.

Document the demarc at every site

For a multi-location business, an undocumented demarc is operational drag. Carriers often send technicians who have never seen your building. If the only person who knows that the T1 smart jack is behind the supply shelf is the office manager who left last year, you pay for it in truck rolls and hours.

Keep a central circuit registry. At a minimum, each row should hold:

Site name and address
Carrier and circuit ID
Service type and bandwidth
Demarc location (room, wall, rack, and whether it is the MPOE or an extension)
Interface type (fiber handoff, RJ45 Ethernet, 66-block, smart jack)
Photos of the demarc and its labeling
Carrier support number and account number
Date of last verification

Label cables too. Public school facility standards, for instance, require identification labels placed close to the cable end, and the same discipline works in any commercial site. Tags within about 4 inches of the end are easy to read in a crowded rack.

Re-verify the registry whenever a carrier changes, a circuit is upgraded, or a site moves.

Demarcation and common upgrades

Moving from copper to fiber. The new demarc is usually a different device in a different place. Confirm where the fiber enters, where the optical terminal goes, and who supplies power. A site that had a punch-down block by the phone closet may now need a powered unit and a protected outlet.

Replacing POTS lines. Analog lines for alarms, elevators, and fax often terminate at a legacy block. Before you cut them, map every endpoint. Our guide on POTS line replacement for California businesses walks through that planning, and fax users should see why fax over IP fails with even small packet loss.

New fiber builds. Construction charges depend partly on how far the fiber must run to reach the demarc you specify. Our post on cutting fiber construction charges covers procurement rules worth knowing before you sign.

Multi-tenant buildings and studio lots. Several carriers, shared risers, and extended demarcs are normal. See how we approach commercial multitenant and studio lot networks.

Distribution and warehouses. Large footprints mean long internal runs between the entrance and the office. For those sites, see our logistics and distribution page.

Our perspective: treat the demarc as a design decision

Most teams treat the demarc as something that happens to them: the carrier shows up, drops a box, and leaves. We think that is backwards. Where the handoff sits, what interface it uses, and who owns the cabling behind it are choices you can make during design, and they shape your uptime for years.

As a managed network services provider we source from more than 50 carriers, so we see the same problem across all of them. The outage is rarely a mystery in the carrier's core. It is a question of where the line is, and nobody wrote it down. A handoff at the wrong end of a long internal run, a smart jack nobody can find, a router powered from a shared outlet: these are design flaws, and they are fixable.

Our approach is to treat each site's demarc as part of the circuit. Our own engineers design and deploy each site, and our 24/7 U.S.-based NOC works from the circuit ID and handoff details. When a site goes quiet, we want to be able to say within minutes which side of the line the fault sits on, and we use our Netverge monitoring to help do it without sending someone to the building first.

One practical rule: never accept a circuit without a written handoff description. That means interface type, location, and who supplies power. It takes five minutes at order time and saves a day at the first outage.

— Jim

How we help multi-site teams

If you manage many locations and don't want to chase each carrier about handoffs, we can be the single point of contact. We handle dedicated fiber internet, managed SD-WAN across multiple carriers, and the managed LAN/WAN behind the demarc. You get one provider, one bill, and one engineer's number. To see everything we manage, start at our managed services overview.

FAQ

What is the purpose of a demarcation point?

It marks where the provider's responsibility ends and the customer's begins. That tells everyone who owns the equipment and wiring on each side, and who pays for repairs. It also gives technicians a standard place to test the circuit.

What does demarc mean in networking?

In networking, the demarc is the handoff between the carrier's service and your network. For modern circuits it is often an Ethernet port on a carrier-provided router, switch, or ONT. Your firewall or edge router connects there.

What is a demarc extension?

A demarc extension is the cabling that carries the circuit from the demarc to where your equipment sits, such as a server room on another floor. It is usually the customer's responsibility, though some carriers will install it for a fee. Ask before ordering whether the carrier will deliver to the demarc or to your room.

Can the demarc be moved?

Sometimes. In multi-tenant buildings, a premises owner can ask the provider to relocate it to the MPOE, and the FCC rule requires good-faith negotiation. Tenants usually need the owner's cooperation and should check their lease and the carrier's terms first.

What is a demarc room?

It is the secured telecommunications room, often the MDF or the entrance room, where carrier circuits terminate. In larger buildings it holds both carrier and customer hardware, and good practice is to restrict access and control temperature and moisture.

Circuit Demarcation Explained: Where the Carrier Ends