What is DMARC? The policy that protects your domain

SPF lists the servers that may send for your domain. DKIM signs each email. But neither one, on its own, looks at the address people actually see in their inbox, and neither tells the receiving server what to do when a check fails. That is DMARC's job.

DMARC ties SPF and DKIM to your visible From address, lets you decide what happens to email that fails, and sends you reports about everyone sending in your name. This guide explains how it works, what alignment means, and how to tighten your policy without sending your own emails to spam.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a short TXT record published at _dmarc.yourdomain.com. It does three things:

• It checks alignment. An email passes DMARC only if SPF or DKIM passes for the same domain as the From address the reader sees.
• It sets a policy. You decide what receivers do with email that fails: deliver it anyway, send it to spam, or reject it.
• It sends reports. Inbox providers send you a daily summary of every server that sent email as your domain, and whether it passed.

Without DMARC, anyone can send an email showing your domain in the From line, and the receiving server has to guess whether it is genuine. With DMARC, you tell it.

How DMARC works

1. 1
   The email arrives and is checked. The receiving server runs SPF and DKIM as usual.
2. 2
   It reads your DMARC record at _dmarc on the domain of the From address.
3. 3
   It checks alignment. Did SPF pass for a domain matching the From? Did DKIM pass with a signature (d=) matching the From? One aligned pass is enough.
4. 4
   It applies your policy. With an aligned pass, the email passes DMARC. Without one, your policy decides: none, quarantine or reject.
5. 5
   It reports back. The result is added to the daily report sent to the address in your record.

What is DMARC alignment?

Alignment is the part of DMARC that trips people up most, and the one that makes it useful.

An email has several domains in it. The From is what the reader sees. The Return-Path, checked by SPF, is often your sending service's domain. The DKIM signature carries the domain that signed it in d=. A spammer can pass SPF and DKIM for their own domain while showing yours in the From. Alignment closes that gap: the domain that passed has to match the From.

By default, alignment is relaxed: news.acme.com aligns with acme.com, because they share the same organizational domain. With strict alignment (adkim=s or aspf=s), only the exact same domain counts.

What does a DMARC record look like?

DMARC policies: none, quarantine and reject

• p=none is monitoring mode. Failing email is delivered as usual, and you receive reports. It is where everyone should start, and it is enough for the Gmail and Yahoo sender rules. But it does not stop anyone from spoofing your domain.
• p=quarantine sends failing email to the spam folder. A good middle step once your reports show that your real services all pass.
• p=reject has failing email refused outright. The strongest protection against phishing in your name, and the goal for most domains.

How to set up DMARC

1. 1
   Make sure SPF and DKIM are in place for every service that sends as your domain, with DKIM signing for your own domain.
2. 2
   Publish a monitoring record. Add a TXT record named _dmarc with a value like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
3. 3
   Read the reports for a few weeks. They are XML files; a DMARC report service turns them into something readable. Look for servers you do not recognise and services that fail alignment.
4. 4
   Fix every legitimate service that fails. Usually by setting up DKIM with your domain, or a custom Return-Path for SPF.
5. 5
   Tighten step by step. Move to p=quarantine, optionally with pct= below 100 at first, then to p=reject once only your own services show up.

If reports go to an address on another domain (a report service, for example), that domain has to publish a small record authorizing it, otherwise receivers will not send the reports. Report services set this up for you.

How to check your DMARC record

Enter your domain below. The checker finds your DMARC record (or the one your subdomain inherits), reads your policy and explains every tag.

On a real email, show the original message: the Authentication-Results header contains dmarc=pass or dmarc=fail, with the policy that was applied and the domain of the From.

Common DMARC mistakes

• Staying on p=none forever. It satisfies the sender rules but protects nothing. Use it to learn, then move on.
• No rua= address. Without reports, you cannot see what would break before you tighten your policy.
• Going to p=reject too fast. A service you forgot, like an invoicing tool or a help desk, starts landing in spam or bouncing. Read the reports first.
• Two DMARC records. Receivers ignore DMARC entirely when there are two. Keep one.
• Relying on SPF alone. SPF often passes for your provider's domain, not yours, and breaks when email is forwarded. Aligned DKIM is what keeps DMARC passing.
• Forgetting subdomains. They inherit the parent's policy unless sp= says otherwise. A strict policy on the parent applies to a subdomain you send from too.

SPF, DKIM and DMARC: the full picture

SPF says which servers may send. DKIM proves each email is genuine and unchanged. DMARC checks that either one passed for the domain people actually see, decides what happens when they do not, and reports back. Together, they are what Gmail, Yahoo and Outlook expect before trusting your email.

Check all three at once, and whether you meet the Gmail and Yahoo rules, with the Deliverability Setup Checker.