What is a DMARC record?
DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is your instruction to inbox providers. It answers one question: what should they do with an email that claims to come from your domain but fails SPF and DKIM?
Without DMARC, anyone can send emails that look like they come from you, and receivers have to guess. With it, you decide: let them through, send them to spam, or reject them. You also get reports showing who sends email in your name.
A DMARC record lives at _dmarc.yourcompany.com and looks like this: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com. The checker above takes yours apart tag by tag.
DMARC policies explained: none, quarantine, reject
The p= tag is the heart of the record.
- `p=none` is monitoring mode. Failing emails are delivered as usual, and you receive reports. It is where everyone should start, and it satisfies the Gmail and Yahoo rules, but it does not stop anyone from spoofing your domain.
- `p=quarantine` sends failing emails to spam. A good middle step once your reports show that all your real services pass.
- `p=reject` has failing emails refused outright. The strongest protection against phishing in your name, and the goal for most domains.
How to read your DMARC record
Beyond the policy, a few tags shape how DMARC behaves.
- `rua=` is where daily summary reports are sent. Without it, you are flying blind: always set it to an address you read, or to a DMARC report service.
- `sp=` sets a different policy for subdomains. Without it, subdomains follow
p=. - `pct=` applies the policy to only part of the failing mail, like
pct=25. Useful while moving to a stricter policy, but the goal is 100. - `adkim=` and `aspf=` set alignment: relaxed (
r, the default) lets a subdomain match your From domain, strict (s) requires the exact domain.
DMARC requirements for Gmail and Yahoo
Since February 2024, anyone sending more than about 5,000 emails a day to Gmail or Yahoo addresses must have a DMARC record. Any policy counts, p=none included. Microsoft followed with similar rules for Outlook in 2025.
DMARC also needs alignment: SPF or DKIM must pass for the same domain as your From address. An email can pass SPF for your provider's domain and still fail DMARC for yours. That is why DKIM signed with your own domain matters so much.
How to move from p=none to p=reject safely
Tightening DMARC too fast sends your own emails to spam. Go step by step.
- Start with `p=none` and an `rua=` address. Watch the reports for a few weeks.
- Fix every service that fails. Each tool that sends as your domain needs SPF or, better, DKIM aligned with it.
- Move to `p=quarantine`, possibly with
pct=below 100 at first, and keep reading the reports. - Finish with `p=reject` once only your own services appear in the reports.