What is DMARC?

What does DMARC do?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is defined in RFC 7489. It protects the domain in the visible From address, the one people see in their mail client. Without DMARC, anyone can send a message that shows your domain as the sender, and the receiving server has no instruction from you on what to do with it.

A DMARC record is a DNS TXT record that does three things. It states that the domain uses DMARC. It tells receivers what to do with mail that fails the check. And it asks receivers to send reports about the mail they saw from your domain.

DMARC does not stop look-alike domains, such as a domain with one letter changed. It only covers the exact domain, and its subdomains, that publish the record.

How does DMARC use SPF and DKIM?

DMARC does not authenticate mail on its own. It builds on two older standards.

• SPF lists the servers that may send mail for a domain. It checks the envelope sender (the Return-Path), not the From address people see.
• DKIM adds a cryptographic signature to each message. The signature names a signing domain in the d= tag, and the receiver checks it against a public key in DNS.

A message passes DMARC when at least one of SPF or DKIM passes and the domain that passed is aligned with the From domain. Both can pass and the message can still fail DMARC if neither domain matches the From address. This is common with third-party services that send with their own domain in the Return-Path and DKIM signature.

What is DMARC alignment?

Alignment means that the domain verified by SPF or DKIM matches the domain in the From address. DMARC has two modes, set separately for SPF (aspf) and DKIM (adkim).

• Relaxed alignment is the default. The domains must share the same organisational domain, so mail.example.com aligns with example.com.
• Strict alignment requires an exact match. With adkim=s, a DKIM signature from mail.example.com does not align with a From address at example.com.

Most organisations keep relaxed alignment. Strict alignment is useful only when you need to keep subdomains apart from each other.

What do p=none, p=quarantine and p=reject mean?

The p= tag is the policy. It tells receivers what you want done with mail that fails DMARC. Receivers may still apply their own judgement, but large mailbox providers generally follow the policy.

• p=none asks for no action. Mail is delivered as it would have been without DMARC, and you receive reports. This is the monitoring stage.
• p=quarantine asks receivers to treat failing mail as suspicious. In practice this usually means the spam or junk folder.
• p=reject asks receivers to refuse failing mail during the SMTP session, so it never reaches the recipient.

The sp= tag sets a separate policy for subdomains. If sp= is missing, subdomains use the same policy as p=.

What does a DMARC record look like?

The record is published as a TXT record on the _dmarc label under your domain. A typical starting record looks like this:

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

v=DMARC1 must come first. p= is the policy. rua= is the address that receives aggregate reports. Optional tags include sp= for subdomains, adkim= and aspf= for alignment, and ruf= for failure reports. If the rua address is on a different domain, that domain must publish a record that authorises it to receive your reports.

What is in a DMARC aggregate (rua) report?

Aggregate reports are XML files that receivers send, usually once a day. Each report covers the mail that one receiver saw from your domain during the period.

A report lists the sending IP addresses, how many messages each sent, the SPF and DKIM results, whether each result was aligned, and what the receiver did with the mail. Reports do not contain message content, and they normally do not contain recipient addresses.

These reports are how you find every service that sends mail as your domain, including ones you had forgotten about. The raw XML is hard to read at volume, so most organisations use a tool to collect and summarise it. DMARC Vision is one such service; it collects aggregate reports and explains the results.

What are DMARC failure (ruf) reports?

Failure reports, also called forensic reports, are sent per message when a message fails. They can include headers, sender and recipient addresses, the subject line, and sometimes parts of the message body.

That makes them personal data under the GDPR, and they may contain confidential content. Many large mailbox providers do not send failure reports at all for this reason. Add a ruf= address only if you have a clear purpose for the data and a place to store it securely.

Is DMARC required by Google, Yahoo and Microsoft?

Since February 2024, Google and Yahoo require bulk senders to publish a DMARC record. Google defines bulk senders as those sending around 5,000 or more messages a day to personal Gmail accounts. The record may be p=none, but the From domain must align with SPF or DKIM, and the sender must have both SPF and DKIM in place.

Microsoft introduced similar rules for Outlook.com, Hotmail and Live.com in May 2025, for domains sending more than 5,000 messages a day to those services. Mail that does not meet them can be sent to junk or rejected.

Even if you send less mail than that, publishing a DMARC record is good practice. It is also the only way to see who sends mail in your domain's name.