What is DMARC? A Guide to Policies, Records & Reports
Discover what DMARC is, how it combines SPF and DKIM to shield your domain, what the none/quarantine/reject policies do, and how to publish a DMARC record and interpret its reports.
DMARC—short for Domain-based Message Authentication, Reporting, and Conformance—is the email authentication standard that sits above SPF and DKIM, shielding your domain from spoofed messages and phishing attacks.
SPF and DKIM perform the actual verification; DMARC's role is different. It defines what should happen to messages that fail those checks, and it delivers ongoing reports so you can see exactly how your domain is being used.
How DMARC Works
Think of DMARC as the enforcement and visibility layer built on SPF and DKIM. The flow looks like this:
1. Email Authentication
On arrival, the receiving server evaluates the message against SPF and DKIM. DMARC can only pass if at least one of those two checks succeeds.
2. Alignment Check
Next comes "identifier alignment": the server verifies that the domain shown in the visible "From" header matches the domain that actually passed SPF or DKIM.
3. Policy Application
When both authentication and alignment succeed, the message goes through normally. When they don't, the receiver applies whatever policy you published: none (observe only), quarantine (divert to spam), or reject (refuse delivery).
4. Reporting
Participating mailbox providers email you daily summaries covering every message that claimed your domain as its sender, along with how each one fared in authentication.
DMARC Requires SPF or DKIM
DMARC has no authentication mechanism of its own—it depends entirely on SPF and/or DKIM being in place. Its contribution is the policy enforcement and reporting built on top of them.
DMARC Record Syntax
You publish DMARC as a TXT record at _dmarc.yourdomain.com. A typical record looks like this:
_dmarc.yourdomain.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:forensic@yourdomain.com; pct=100; adkim=r; aspf=r"
# Breaking down the components:
# v=DMARC1 -> DMARC version
# p=quarantine -> Policy (none, quarantine, or reject)
# rua=mailto:dmarc@yourdomain.com -> Aggregate report email
# ruf=mailto:forensic@yourdomain.com -> Forensic report email
# pct=100 -> Percentage of mail to apply policy (100%)
# adkim=r -> DKIM alignment mode (r=relaxed, s=strict)
# aspf=r -> SPF alignment mode (r=relaxed, s=strict)DMARC Policy Tags
| Tag | Description | Required |
|---|---|---|
| v | Protocol version (always DMARC1) | Yes |
| p | Enforcement policy: none, quarantine, or reject | Yes |
| rua | Where aggregate reports are delivered | Recommended |
| ruf | Where forensic reports are delivered | Optional |
| pct | Share of mail the policy applies to (0-100) | Optional |
| sp | Separate policy for subdomains | Optional |
| adkim | DKIM alignment mode: r (relaxed) or s (strict) | Optional |
| aspf | SPF alignment mode: r (relaxed) or s (strict) | Optional |
Understanding DMARC Policies
There are three policy levels, and the safest approach is to move through them in order:
p=none (Monitor Mode)
Failing messages are delivered as usual—nothing is blocked. This mode exists purely to collect reporting data, making it the right starting point while you audit your authentication.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comBest for: First deployments, data collection, validating your configuration
p=quarantine (Quarantine Failed Mail)
Messages that fail authentication get diverted into recipients' spam or junk folders. It's a sensible intermediate step—your domain gains real protection with limited risk to legitimate delivery.
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100Best for: Once monitoring shows your legitimate mail authenticates reliably
p=reject (Block Failed Mail)
Failing messages are refused at the door and never delivered. Nothing protects your domain more thoroughly—but it demands a flawless authentication setup across every mail stream.
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100Best for: Well-established setups where every sender authenticates correctly
Progressive Implementation
Begin every rollout at p=none and observe for a minimum of 2-4 weeks. Work through the reports, resolve any authentication gaps, and only then step up to p=quarantine and eventually p=reject.
How to Set Up DMARC
Ensure SPF and DKIM are Working
Since DMARC depends on SPF or DKIM (ideally both), confirm those records are published and passing before you go any further.
Create a Mailbox for Reports
Stand up a dedicated address such as dmarc@yourdomain.com to collect the reports—they arrive daily and can pile up quickly, so keep them out of your personal inbox.
Create Your DMARC Record
Begin in observation mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100Add to DNS
Publish it as a TXT record under _dmarc.yourdomain.com
Monitor Reports
Spend 2-4 weeks reading the incoming reports. Hunt for authentication failures and flag any genuine sending sources that still need their SPF or DKIM set up.
Gradually Increase Policy
When the data looks clean, switch to p=quarantine, watch the reports again, and finish with p=reject if you want maximum protection.