[ Quick answer ]
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain: deliver it (p=none), send it to spam (p=quarantine) or block it (p=reject). It also sends you reports on every source using your domain.
Key facts
- ›Published at _dmarc.yourdomain.com as a TXT record starting v=DMARC1.
- ›Three policies: p=none (monitor), p=quarantine (spam folder), p=reject (block).
- ›A message passes DMARC if SPF or DKIM passes and aligns with the From domain.
- ›rua= receives daily aggregate XML reports; ruf= receives failure samples.
- ›Only p=quarantine or p=reject actually stops spoofing.
Reviewed 2026-11-02 · EmailAuth research team
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication standard, defined in RFC 7489, that lets a domain owner tell receiving mail servers what to do with messages that fail authentication and claim to come from that domain. It builds on SPF and DKIM, adds domain alignment, and returns reports so you can see who sends email as your domain. In short, DMARC stops attackers from spoofing your domain and gives you visibility into every source using it.
How DMARC works
When a receiver gets a message, it checks SPF and DKIM. SPF (RFC 7208) verifies the sending IP is authorized by the domain in the Return-Path. DKIM verifies a cryptographic signature tied to a domain. DMARC then applies alignment: the domain that passed SPF or DKIM must match the domain in the visible From header. If at least one passes and is aligned, DMARC passes. If both fail alignment, the receiver applies your published policy.
The three DMARC policies
- p=none: monitor only. No action is taken on failing mail, but reports are still sent. Use this to observe traffic first.
- p=quarantine: failing mail is sent to spam or held. A safer middle step during rollout.
- p=reject: failing mail is blocked outright. This is full protection and the goal for every domain.
Why alignment matters
Alignment is what separates DMARC from raw SPF or DKIM. An attacker can make SPF pass for their own domain, but they cannot make it align with your From header. DMARC alignment can be strict (an exact domain match) or relaxed (the organizational domain must match). Relaxed is the default and works for most senders.
A minimal DMARC record
v=DMARC1; p=none; rua=mailto:rua@example.com
Reporting and rollout
DMARC produces two report types: aggregate reports (RUA), which summarize authentication results across all sources, and forensic reports (RUF), which capture details of individual failures. Start at p=none, read your RUA data, authorize every legitimate source with SPF and DKIM, then move to quarantine and finally reject. EmailAuth parses RUA and RUF into readable dashboards, and you can run a free domain scan to see your current posture in minutes.
Why DMARC is now required
In 2024, Google and Yahoo made DMARC mandatory for bulk senders (those sending more than 5,000 messages a day). Bulk senders must publish at least a p=none DMARC record, authenticate with SPF and DKIM, and keep spam complaints low. DMARC is also the foundation for BIMI, which displays your verified logo in the inbox.
Frequently asked questions
Is DMARC the same as SPF and DKIM?
No. SPF and DKIM are the two authentication methods DMARC relies on. DMARC adds alignment between the authenticated domain and the visible From address, a policy for handling failures, and reporting. You need SPF or DKIM in place for DMARC to work.
Does DMARC stop all phishing?
DMARC stops exact-domain spoofing, where an attacker sends mail claiming to be from your registered domain. It does not stop look-alike domains or display-name tricks. It is one strong layer, best paired with user training and lookalike-domain monitoring.
What DMARC policy should I start with?
Start with p=none so you collect reports without affecting delivery. Once RUA data confirms all legitimate senders pass and align, move to quarantine, then reject. Rushing to reject before your sources are authenticated can block real mail.
How long does DMARC take to deploy?
Monitoring begins as soon as you publish a record and DNS propagates, usually within a day. Reaching a safe p=reject typically takes a few weeks to a couple of months, depending on how many sending services you use and how quickly you authenticate them.
What is DMARC in email?
It is the policy layer of email authentication. It checks that the domain authenticated by SPF or DKIM matches the From address readers see, and tells receivers how to handle mail that does not.
What does DMARC stand for?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is defined in RFC 7489.
How does DMARC work?
A receiving server checks SPF and DKIM on the message, then checks that at least one of them passed for a domain aligned with the visible From address. If neither aligns, it applies the policy you publish (none, quarantine or reject) and sends you reports.
What are SPF, DKIM and DMARC records?
All three are DNS TXT records. SPF lists the servers allowed to send for your domain, DKIM publishes a public key used to verify message signatures, and DMARC tells receivers what to do when SPF and DKIM do not align with your From domain.
How do I set up DMARC?
Publish SPF and DKIM for every sender, then add a TXT record at _dmarc.yourdomain.com such as v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Read the aggregate reports, fix failing senders, and move to p=quarantine and then p=reject.
How do I read a DMARC report?
Aggregate (RUA) reports are XML files listing each sending IP, message count, and SPF, DKIM and DMARC results. Upload them to a DMARC report analyzer to see which sources pass, which fail, and which are not yours.
What does DMARC quarantine/reject policy not enabled mean?
Security scanners show this when your DMARC record uses p=none. Your domain is monitored but not protected; move to p=quarantine and then p=reject once legitimate senders pass.
[ DMARC guide ]