Skip to content
DDMARC
Core conceptThe DDMARC Library

What is DMARC?

DMARC tells receivers what to do with mail that fails SPF and DKIM, and reports back to you. Record syntax, p=none vs reject, and what the first report shows.

By the DDMARC editorsRevised 5 min read

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the email authentication standard that tells receivers what to do with mail that fails SPF and DKIM for your domain, and asks them to report back to you.

Published as a DNS TXT record, a DMARC policy tells receivers: "If an email claims to come from my domain but fails authentication, here is what you should do with it — and please send me reports about it."

How does DMARC work?

DMARC builds on top of two existing protocols: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). When a receiving mail server gets a message, it runs both checks and then evaluates DMARC alignment.

Alignment means the domain in the From: header — what the recipient sees — must match the domain authenticated by SPF or DKIM. Without alignment, a spammer could pass SPF on a different domain and still spoof your brand's From: address.

A message passes DMARC if at least one of the following is true:

  • SPF passes and the SPF-authenticated domain aligns with the From: domain
  • DKIM passes and the DKIM d= domain aligns with the From: domain
How DMARC evaluates an incoming emailAn inbound message is checked against SPF and DKIM, then DMARC tests whether a passing check is aligned with the From: domain. If authenticated and aligned the message is delivered; otherwise the domain owner's DMARC policy (none, quarantine, or reject) is applied. An aggregate report is sent to the domain owner either way.Inbound emailFrom:@yourdomain.comSPF checksending IP authorized?DKIM checksignature valid?DMARC alignmentdoes a passing checkmatch the From: domain?Pass → deliveraligned & authenticatedFail → apply policynone · quarantine · rejectAggregate (RUA) report → sent to the domain owner, pass or fail
How DMARC evaluates each message: SPF and DKIM are checked, alignment is tested against the From: domain, then your policy decides the outcome — and you get a report either way.

The three DMARC policies

The p= tag in your DMARC record defines what happens to messages that fail:

  • p=none — Monitor mode. No action is taken on failing messages. Reports are still sent. Use this when first deploying DMARC to understand your email traffic before enforcing.
  • p=quarantine — Failing messages are sent to the spam/junk folder. A middle ground that provides some protection while you refine your setup.
  • p=reject — Failing messages are refused outright by the receiving server. This is the strongest protection and the goal of full DMARC deployment.

Why is DMARC important?

Without DMARC, anyone can send an email with your domain in the From: header. Attackers exploit this to impersonate your brand in phishing attacks, business email compromise (BEC) scams, and spam campaigns. DMARC with a reject policy closes this vector.

Beyond security, DMARC improves email deliverability. Major providers like Gmail and Microsoft give preferential treatment to authenticated, policy-enforced domains. Google and Yahoo now require DMARC for bulk senders. If you are evaluating a DMARC monitoring tool, see how DDMARC compares to EasyDMARC, Dmarcian, and others.

DMARC report types

DMARC sends two types of reports back to domain owners:

  • Aggregate reports (RUA) — XML summaries sent daily by receiving mail servers. They show source IPs, volume, and SPF/DKIM pass/fail counts. Essential for understanding your email ecosystem.
  • Forensic reports (RUF) — Detailed reports triggered by individual authentication failures. They include message headers and are useful for diagnosing specific problems, though many providers have stopped sending them for privacy reasons.

How to set up DMARC

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. Here is a minimal example:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

A more complete production record with forensic reports and a subdomain policy:

v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc-rua@yourdomain.com; ruf=mailto:dmarc-ruf@yourdomain.com; fo=1

Key tags explained:

  • v=DMARC1 — Required. Identifies this as a DMARC record.
  • p= — Policy: none, quarantine, or reject.
  • sp= — Subdomain policy (defaults to the main policy if omitted).
  • np= — Policy for subdomains that do not exist in DNS (added in RFC 9989).
  • t= — Test mode. t=y asks receivers to apply one level below p= while you watch the reports (added in RFC 9989, replacing pct=).
  • rua= — Email address for aggregate reports.
  • ruf= — Email address for forensic reports.
  • fo= — Forensic reporting options: 0 (both fail), 1 (any fail), d (DKIM fail), s (SPF fail).

Common issues

  • Third-party senders not authenticated — Email service providers (CRMs, marketing tools) sending on your behalf must be included in your SPF record or configured with DKIM signing using your domain.
  • Forwarding breaks DMARC — When email is forwarded, the SPF check re-runs against the forwarder's IP, which may fail. DKIM usually survives unless the message body is modified. This is why p=quarantine can be useful before moving to reject.
  • Moving too fast to reject — Always deploy p=none first, analyze reports for 2–4 weeks, authorize all legitimate senders, then gradually enforce.

Frequently asked questions

Does DMARC replace SPF and DKIM?

No. DMARC builds on SPF and DKIM. A message passes DMARC when at least one of them passes and aligns with the From: domain. DMARC adds the policy that tells receivers what to do with mail that fails, and the reports that show you who is sending as your domain. Set up both SPF and DKIM: DKIM usually survives forwarding, and SPF breaks when mail is forwarded.

How long does it take to see DMARC reports?

Most major mail providers send aggregate reports once per day, covering the previous 24-hour period. You should start receiving reports within 24–48 hours of publishing your DMARC record — but only if you have the rua= tag set.

Can DMARC hurt my email deliverability?

A p=none policy has no impact on delivery. Moving to reject before authorizing all legitimate senders can cause legitimate email to be blocked. Always analyze reports thoroughly before enforcing. Check your domain's current DMARC setup to see where you stand.

Sources

  1. RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
  2. RFC 9990: DMARC Aggregate Reporting
  3. RFC 9991: DMARC Failure Reporting
  4. RFC 7489: the original DMARC specification, obsoleted by RFC 9989
ShareX / TwitterLinkedIn
Read next
What is SPF?SPF lists the servers allowed to send as your domain. Syntax, ~all vs -all, the 10-lookup limit that silently breaks it, and how to check yours.What is DKIM?DKIM signs each message with a key you publish in DNS. Selectors, 2048-bit keys, why it survives forwarding, and how to check a key by selector.DMARC Alignment ExplainedMail can pass SPF and DKIM and still fail DMARC. Relaxed vs strict alignment, the From: domain rule, and the third-party senders that break it.
From the blog

Applied guides on this topic

4 min readReading DMARC Aggregate Reports: the XMLAggregate reports show who is sending as your domain. How to read the XML, what each field means, and how to tell spoofing from a broken forwarder.6 min readDMARC Rollout Playbook: p=none to p=rejectMoving from p=none to p=reject is where most DMARC projects stall. A staged, evidence-driven path to enforcement that will not block legitimate mail.

See what your own domain is publishing.

Everything in this article is externally observable. The free checker reads your records and tells you which of them are missing, weak, or already doing their job.

Look up my DMARC record Start free: 2 domains, no card
No signup. Reads public DNS only.