Guide

What is DMARC?

DMARC ties SPF and DKIM to the From address your recipients actually see, tells receivers what to do when a message fails, and sends you daily reports about everyone sending as your domain.

The gap it closes

SPF checks the envelope sender. DKIM checks a signing domain. Neither is required to match the From address a person reads in their mail client — so a forger can pass SPF for their own domain while displaying yours.

DMARC adds **alignment**: SPF or DKIM must not only pass, but pass *for the domain in the From header*. That is the check that actually stops someone sending as you.

The three policies

p=none asks receivers to do nothing. It is a monitoring mode, and it is the correct place to start — it turns on reporting without risking your mail.

p=quarantine asks receivers to treat failing mail as suspicious, usually by filing it as spam. p=reject asks them to refuse it outright.

Gmail and Yahoo now require a DMARC record for anyone sending bulk mail to their users, which is why adoption jumped sharply in 2024.

The reports are the point

A rua= address receives daily aggregate reports in XML from every major receiver: which servers sent mail as your domain, and whether each passed SPF and DKIM alignment.

That data is the only safe way to know whether tightening your policy would block legitimate mail. Without it you are guessing, which is why a record with no rua= almost always stays on p=none forever.

Example

A monitoring record, published at _dmarc.example.com

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100"

`p=none` is not protection, and most checkers call it a pass

A record with p=none exists, parses, and does nothing. Receivers take no action on mail that fails, so forgery is delivered exactly as before — and most tools report "DMARC found" with a green tick. Watch pct= for the same reason: p=reject; pct=1 reads as strict and enforces on one message in a hundred. p=none is where you begin, not where you stop.

Check the DMARC policy on your domain.