DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds on SPF and DKIM to protect your domain from spoofing and phishing. It tells receiving servers what to do when a message fails those checks (none to monitor, quarantine to send to spam, reject to block) and sends you reports on who is sending email as your domain.

What is a DMARC policy?

The DMARC policy (the p= tag) sets how receiving servers handle email that fails authentication. p=none monitors and takes no action, p=quarantine sends failing email to spam, and p=reject blocks it. Start with p=none to gather data, then tighten to quarantine and reject once every legitimate sender is authenticated.

What does p=reject mean in DMARC?

p=reject is the strictest policy: email that fails DMARC is refused and never delivered. It gives the most protection against phishing and spoofing, but every legitimate source (newsletters, CRMs, transactional tools) must pass SPF or DKIM with alignment before you turn it on.

How do I add a DMARC record?

Add a TXT record named _dmarc.yourdomain.com. Start with a monitoring value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. This records activity without affecting delivery. After 2 to 4 weeks of reports, and once SPF and DKIM pass for every sender, move to p=quarantine and then p=reject.

Is DMARC required for email deliverability?

Since February 2024, Google and Yahoo require a DMARC record (at least p=none) for bulk senders sending more than 5,000 emails a day to Gmail or Yahoo addresses. Smaller senders are not strictly required to have one, but it is strongly recommended for every domain: it improves deliverability and blocks phishing in your name.

What is DMARC? Policy, Setup & Reporting Explained

How DMARC works

SPF and DKIM say whether a message passed a check. DMARC adds two things: it requires the domain that passed to match the one in the From address, and it tells the receiver what to do when nothing does.

SPF and DKIM run
The receiving server checks both. At least one has to pass for DMARC to pass.
Alignment is checked
The domain that passed SPF or DKIM must match the domain in the From header. This is called identifier alignment.
Your policy is applied
If a check passes and aligns, the message is delivered. If not, the receiver follows your policy: none, quarantine or reject.
You get a report
Receivers send daily reports to the address in your record, covering every message that claimed to be from your domain.

Your receipt from Acme

From billing@acme.com

DKIM, acme.com: Pass
Aligned: Yes
DMARC: Pass

Your account is on hold

From billing@acme.com

SPF, mailer.net: Pass
Aligned: No
DMARC: Fail

Both messages pass a check. Only the one signed by acme.com aligns with the From address.

DMARC does not work on its own. Set up SPF and DKIM first.

Reading a DMARC record

A DMARC record is a TXT record at _dmarc.yourdomain.com. Only the version and the policy are required.

TXT record on _dmarc.acme.com

v=DMARC1; p=quarantine; rua=mailto:dmarc@acme.com; ruf=mailto:forensic@acme.com; pct=100; adkim=r; aspf=r

Tag	What it means	Required
v	The version. Always DMARC1.	Yes
p	The policy: none, quarantine or reject.	Yes
rua	Where to send aggregate reports.	Recommended
ruf	Where to send forensic reports on single failures.	Optional
pct	The percentage of failing mail the policy applies to (0 to 100).	Optional
sp	The policy for subdomains.	Optional
adkim	DKIM alignment: r (relaxed) or s (strict).	Optional
aspf	SPF alignment: r (relaxed) or s (strict).	Optional

Relaxed alignment accepts a subdomain (mail.acme.com aligns with acme.com). Strict needs an exact match. Relaxed is the default and right for most domains.

The three policies

The policy only affects mail that fails DMARC. Move through the three in order, one step at a time, as reports confirm your own mail passes.

Nonep=none

Monitor while you collect reports

Delivered

Quarantinep=quarantine

Once your own mail passes

Spam folder

Rejectp=reject

Full protection

Blocked

The same failing message under each policy. Only none lets it through.

Reading DMARC reports

Aggregate reports (rua) arrive daily from each large mailbox provider as XML files. They list every server that sent mail as your domain, how many messages it sent, and whether they passed SPF, DKIM and alignment. Forensic reports (ruf) describe single failed messages, but few providers send them.

Report from google.com

Oct 16

Plunk

12,480 messages

Pass

Google Workspace

1,204 messages

Pass

Help desk

310 messages

Not aligned

192.0.2.44

58 messages

Fail

Each row is a source sending as your domain. Fix the ones you recognise before you enforce.

Reports can be large and frequent, so send them to a dedicated mailbox. Sources you recognise that fail need SPF or DKIM set up; sources you do not recognise are what your policy will block.

Why DMARC matters

Blocks spoofing
At p=reject, forged mail in your name is refused outright.
Required by Google and Yahoo
Bulk senders (5,000+ a day) need at least p=none since 2024.
Shows who sends as you
Reports surface tools and servers you did not know about.
Improves deliverability
An enforced policy is a strong trust signal for inboxes.

How to set up DMARC

Make sure SPF and DKIM pass
DMARC needs at least one of them working for every service that sends as you.
Create a mailbox for reports
For example dmarc@yourdomain.com. Keep it separate from your inbox.
3
Publish a monitoring record
Add a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
Watch reports for 2 to 4 weeks
Find legitimate sources that fail and fix their SPF or DKIM.
5
Tighten the policy
Move to p=quarantine, monitor again, then to p=reject. Check each change with the DMARC checker.
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

What is DMARC?