20 guides · six layers · read in order

These protocols only make sense in order.

DMARC is not a protocol you can learn on its own — it is a decision made on top of SPF and DKIM, and the concept that trips almost everyone is alignment. So this is a path with prerequisites, not an alphabetical glossary. Tell us what you already know and we will show you where to start.

Reference, kept current; dated when revised. Looking for what changed and when? See the Blog. For adoption figures across the top 10,000 domains, read the State of Email Security 2026 report.

What do you already understand?

Then read Layer 01 in order, all three of them, and stop. They take about fifteen minutes together and everything else on this page depends on them.

Start here

What is SPF?The simplest of the three, and the one the other two assume you know.

Layer 01·5 min read

Layer 01

The three protocols

Nothing else on this page makes sense without these. SPF and DKIM each prove one thing; DMARC decides what to do when the proof fails.

No prerequisites

Protocol5 min readWhat is SPF?Which servers are allowed to send as you — and the ten-lookup limit that quietly breaks it.Protocol5 min readWhat is DKIM?A cryptographic signature that survives relaying, unlike SPF.Protocol5 min readWhat is DMARC?The policy layer: what receivers should do when neither proof holds up.

Layer 02

How DMARC decides

Two concepts do all the work. Alignment is why mail that passes SPF and DKIM can still fail; policy is the choice between watching and blocking.

Needs Layer 01

Concept5 min readDMARC Alignment ExplainedThe single idea behind most failed rollouts. Read this one twice.Decision4 min readDMARC p=none vs p=reject: Which to UseWhen monitoring stops being enough, and how to move without breaking mail.Comparison4 min readSPF vs DKIM: What Is the Difference?Why you need both, not just whichever is easier to set up.Comparison4 min readDMARC vs SPF: How They Work TogetherHow the policy layer and the authorization layer fit together.

Layer 03

Reading the evidence

Once the record is published, providers start sending you data. These explain what arrives, what it means, and how to tell a broken forwarder from an attack.

Needs Layer 02

Reports5 min readDMARC Aggregate Reports ExplainedThe daily XML summary — who sent as you, and whether it passed.Practice5 min readWhat is DMARC monitoring?What to watch in the reports, and how long to watch before enforcing.Reports5 min readDMARC Forensic (Failure) Reports ExplainedPer-message failure samples, and why most providers no longer send them.Comparison4 min readDMARC Aggregate vs Forensic ReportsWhich one answers which question, so you stop waiting for the wrong data.Protocol5 min readWhat is ARC?How forwarding breaks authentication, and what preserves the original result.

Layer 04

Securing the transport

A separate concern from who sent the message: whether the connection carrying it was encrypted and verified. Useful, and not a prerequisite for enforcement.

Independent branch

Protocol5 min readWhat is MTA-STS?Requiring TLS for inbound mail, published over HTTPS instead of DNS.Reports5 min readWhat is TLS-RPT?Finding out when TLS negotiation failed, instead of never knowing.Foundation5 min readWhat is DNSSEC?Signing DNS itself — the assumption everything above quietly depends on.Protocol5 min readWhat is DANE?Pinning certificates in DNS. Requires DNSSEC, so read that first.

Layer 05

Showing the brand

Your logo in the inbox is the visible payoff — but only after your domain is at enforcement. Do not start here, however much marketing wants to.

Needs enforcement first

Protocol5 min readWhat is BIMI?Your verified logo beside the sender name, gated on p=quarantine or stricter.Comparison4 min readBIMI vs No BIMI: Is It Worth Implementing?The full cost-benefit, including the certificate nobody warns you about.Process5 min readVMC for BIMI: Getting a Verified Mark CertificateThe Verified Mark Certificate: what it costs, who issues it, how long it takes.

Horizon

Not shipped yet

One proposal worth knowing about so you are not surprised when it appears in vendor decks. Nothing here affects what you should do this quarter.

Optional reading

Proposal5 min readWhat is DKIM2? The Proposed Next Generation of DKIMThe proposed successor to DKIM, and why forwarding is the reason it exists.