What Is DMARC?

Why SPF and DKIM alone aren't enough

SPF tells a receiving server which mail servers are allowed to send email for your domain. DKIM lets a receiving server verify that a message's content wasn't altered in transit, using a cryptographic signature. Both are useful, but both have the same gap: neither one tells the receiving server what to actually do when a check fails.

Without DMARC, a spammer can send a forged email claiming to be from your domain, fail every SPF and DKIM check imaginable, and still land in someone's inbox — because "this failed authentication" and "reject this message" are two different decisions, and nothing connects them by default.

What a DMARC record actually says

A DMARC record is a TXT record published at _dmarc.yourdomain.com. A minimal one looks like this:

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com

Three tags matter most:

• p= — the policy: none (do nothing, just report), quarantine (send failing mail to spam), or reject (refuse it outright).
• rua= — where to email aggregate reports: a daily summary of who's sending mail "from" your domain and whether it passed authentication. This is how you discover legitimate senders you forgot about before you tighten the policy.
• pct= — optional; apply the policy to only a percentage of messages while you build confidence.

DMARC also introduces alignment: it's not enough for SPF or DKIM to merely pass — the domain that passed must match (or be a subdomain of) the domain in the visible "From" address. This closes a specific spoofing trick where a message passes SPF for one domain while displaying a completely different "From" address to the reader.

The safe rollout order

Jumping straight to p=reject on a domain that's never had DMARC before is how legitimate mail — invoices, password resets, mail sent through a third-party service you forgot was sending on your behalf — starts silently disappearing. The standard, low-risk path is:

1. Publish p=none with an rua= address and just collect reports for a few weeks.
2. Review the reports, find every legitimate source sending as your domain, and make sure each one passes SPF or DKIM with matching alignment.
3. Move to p=quarantine, optionally at a low pct= first.
4. Once quarantine has run clean for a few weeks, move to p=reject.

Each step is reversible, and each one gives real senders a chance to surface before mail starts bouncing.