DMARCDomain-based Message Authentication, Reporting & Conformance

DMARC sits on top of two existing checks: SPF (did the message come from an IP the domain authorises?) and DKIM (does it carry a valid cryptographic signature from the domain?). On their own, neither check looks at the From: address your recipient actually sees. DMARC closes that gap with a rule called alignment.

For a message to pass DMARC, at least one of SPF or DKIM must pass and be aligned, meaning the domain it authenticated matches the visible From: domain. Alignment can be relaxed (the organizational domain must match, so mail.example.com aligns with example.com) or strict (an exact match is required). If both checks fail, or neither aligns, the receiver applies whatever policy you published.

Your policy is set with the p= tag, and it is the single most consequential part of the record:

• p=none: monitor only. Take no action on failures, but send me the reports. Every sender should start here.
• p=quarantine: treat failing mail as suspicious. Most receivers route it to the spam folder.
• p=reject: block failing mail outright at the SMTP layer, before it can reach the inbox. This is the only policy that actually stops exact-domain spoofing.

The intended path runs from none to quarantine to reject: begin in monitoring, read your aggregate reports until you are confident every legitimate source authenticates and aligns, then tighten. Jumping straight to p=reject before your reports are clean is the fastest way to block your own invoices and password resets.

A DMARC record is a list of tag=value pairs in a single TXT record at _dmarc.yourdomain.com. A typical enforcing record looks like this:

• v=DMARC1: version. Required, and must come first.
• p=reject: the policy for the main domain.
• rua=mailto:…: where to send daily aggregate reports (the ones worth reading).
• adkim=s / aspf=s: require strict DKIM/SPF alignment (r = relaxed, the default).
• pct=100: apply the policy to 100% of mail (ramp with a lower number if you like).
• fo=1: request a failure sample whenever any underlying check fails.

Since February 2024, Google and Yahoo require every bulk sender (anyone sending 5,000 or more messages a day to Gmail or Yahoo accounts) to publish a DMARC record of at least p=none, on top of passing aligned SPF and DKIM. Microsoft began enforcing the same baseline for high-volume senders to Outlook and Hotmail in 2025. Without a record, that mail is now liable to be rejected or sent straight to spam.

Beyond the mandate, DMARC protects the asset your whole reputation is built on: your domain. A published reject policy makes it dramatically harder for spammers to send phishing in your name, and exact-domain spoofing is one of the fastest ways to torch a previously good reputation. The aggregate reports are also the only place you can see every service sending as your domain, including shadow IT and long-forgotten vendors.