# What is DMARC? A Guide to Policies, Records & Reports

Discover what DMARC is, how it combines SPF and DKIM to shield your domain, what the none/quarantine/reject policies do, and how to publish a DMARC record and interpret its reports.

DMARC—short for Domain-based Message Authentication, Reporting, and Conformance—is the email authentication standard that sits above SPF and DKIM, shielding your domain from spoofed messages and phishing attacks.

SPF and DKIM perform the actual verification; DMARC's role is different. It defines what should happen to messages that fail those checks, and it delivers ongoing reports so you can see exactly how your domain is being used.

## How DMARC Works

Think of DMARC as the enforcement and visibility layer built on SPF and DKIM. The flow looks like this:

### 1\. Email Authentication

On arrival, the receiving server evaluates the message against SPF and DKIM. DMARC can only pass if at least one of those two checks succeeds.

### 2\. Alignment Check

Next comes "identifier alignment": the server verifies that the domain shown in the visible "From" header matches the domain that actually passed SPF or DKIM.

### 3\. Policy Application

When both authentication and alignment succeed, the message goes through normally. When they don't, the receiver applies whatever policy you published: none (observe only), quarantine (divert to spam), or reject (refuse delivery).

### 4\. Reporting

Participating mailbox providers email you daily summaries covering every message that claimed your domain as its sender, along with how each one fared in authentication.

#### DMARC Requires SPF or DKIM

DMARC has no authentication mechanism of its own—it depends entirely on SPF and/or DKIM being in place. Its contribution is the policy enforcement and reporting built on top of them.

## DMARC Record Syntax

You publish DMARC as a TXT record at `_dmarc.yourdomain.com`. A typical record looks like this:

Example DMARC Record

```
_dmarc.yourdomain.com  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:forensic@yourdomain.com; pct=100; adkim=r; aspf=r"

# Breaking down the components:
# v=DMARC1                           -> DMARC version
# p=quarantine                       -> Policy (none, quarantine, or reject)
# rua=mailto:dmarc@yourdomain.com   -> Aggregate report email
# ruf=mailto:forensic@yourdomain.com -> Forensic report email
# pct=100                            -> Percentage of mail to apply policy (100%)
# adkim=r                            -> DKIM alignment mode (r=relaxed, s=strict)
# aspf=r                             -> SPF alignment mode (r=relaxed, s=strict)
```

### DMARC Policy Tags

| Tag | Description | Required |
| --- | --- | --- |
| v | Protocol version (always DMARC1) | Yes |
| p | Enforcement policy: none, quarantine, or reject | Yes |
| rua | Where aggregate reports are delivered | Recommended |
| ruf | Where forensic reports are delivered | Optional |
| pct | Share of mail the policy applies to (0-100) | Optional |
| sp | Separate policy for subdomains | Optional |
| adkim | DKIM alignment mode: r (relaxed) or s (strict) | Optional |
| aspf | SPF alignment mode: r (relaxed) or s (strict) | Optional |

## Understanding DMARC Policies

There are three policy levels, and the safest approach is to move through them in order:

1

### p=none (Monitor Mode)

Failing messages are delivered as usual—nothing is blocked. This mode exists purely to collect reporting data, making it the right starting point while you audit your authentication.

```
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
```

**Best for:** First deployments, data collection, validating your configuration

2

### p=quarantine (Quarantine Failed Mail)

Messages that fail authentication get diverted into recipients' spam or junk folders. It's a sensible intermediate step—your domain gains real protection with limited risk to legitimate delivery.

```
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100
```

**Best for:** Once monitoring shows your legitimate mail authenticates reliably

3

### p=reject (Block Failed Mail)

Failing messages are refused at the door and never delivered. Nothing protects your domain more thoroughly—but it demands a flawless authentication setup across every mail stream.

```
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100
```

**Best for:** Well-established setups where every sender authenticates correctly

#### Progressive Implementation

Begin every rollout at `p=none` and observe for a minimum of 2-4 weeks. Work through the reports, resolve any authentication gaps, and only then step up to `p=quarantine` and eventually `p=reject`.

## How to Set Up DMARC

1

### Ensure SPF and DKIM are Working

Since DMARC depends on SPF or DKIM (ideally both), confirm those records are published and passing before you go any further.

2

### Create a Mailbox for Reports

Stand up a dedicated address such as dmarc@yourdomain.com to collect the reports—they arrive daily and can pile up quickly, so keep them out of your personal inbox.

3

### Create Your DMARC Record

Begin in observation mode:

dns

```
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
```

4

### Add to DNS

Publish it as a TXT record under `_dmarc.yourdomain.com`

5

### Monitor Reports

Spend 2-4 weeks reading the incoming reports. Hunt for authentication failures and flag any genuine sending sources that still need their SPF or DKIM set up.

6

### Gradually Increase Policy

When the data looks clean, switch to `p=quarantine`, watch the reports again, and finish with `p=reject` if you want maximum protection.

## Related Email Authentication Guides

- [What is DKIM?](/guides/what-is-dkim): How cryptographic signatures verify your email content.

- [What is SPF?](/guides/what-is-spf): How SPF records declare your authorized mail servers.

- [Email Deliverability Guide](/guides/email-deliverability): Everything you need to reliably reach the inbox.

---

> Source: https://dev.bitelio.com/guides/what-is-dmarc