What Is DMARC?
What DMARC Does
DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is a policy that tells receiving servers what to do with email that claims to come from your domain but fails authentication. It builds on SPF and DKIM. Without DMARC, a receiver may check those results and still deliver a spoofed message, because nothing ties the outcome to the address the recipient sees.
A DMARC policy is published as a TXT record at _dmarc followed by your domain name. The record sets the policy and can request reports. Receivers look up this record for the domain in the From header, which is the name recipients see on screen.
DMARC Policies and Alignment
DMARC has three policies. With none, the domain owner only collects data and receivers take no action. With quarantine, failing mail should be treated as suspicious, usually by sending it to the spam folder. With reject, failing mail should be refused. Many domains start with none to see which services send mail under their name, then move to stricter settings once legitimate mail passes.
Passing DMARC also requires alignment. An SPF pass counts only if the domain checked by SPF matches the domain in the From header, and a DKIM pass counts only if the signing domain matches it. Alignment can be relaxed, which allows subdomains to match, or strict, which needs an exact match. Without alignment, a message can pass SPF or DKIM for an unrelated domain and still fail DMARC.
Reports That Show Who Sends in Your Name
Aggregate reports, sent to the address in the rua tag, are XML summaries of the messages that claimed your domain. They show how many were received, which servers sent them and whether they passed SPF and DKIM. These reports often reveal legitimate services that were never configured, as well as spoofing attempts. A simple monitoring record looks like this: v=DMARC1; p=none; rua=mailto:[email protected]. Forensic reports, requested with the ruf tag, contain samples of failing messages, but many providers do not send them because of privacy concerns.
Full setup and monitoring of SPF, DKIM and DMARC work best when the three are reviewed together.
Frequently asked questions
What happens if I set DMARC to reject?
Receivers that honor the policy will refuse any mail from your domain that fails DMARC, including legitimate messages from services that were never configured. Before you move to reject, review the aggregate reports and confirm that every service sending for your domain passes SPF or DKIM with alignment. Moving in stages, from none to quarantine to reject, lowers the risk.
Is DMARC enough to protect my domain on its own?
No. DMARC relies on SPF or DKIM passing with alignment, so those records must be correct first. DMARC does not authenticate mail by itself. It is the policy layer that tells receivers how to act on the results, and it works best when paired with reports, so that problems are visible and fixed.