Home / Knowledge hub / DMARC
Knowledge hub
DMARC
A DNS policy telling receivers what to do with email that fails SPF and DKIM.
What it means
DMARC, or Domain-based Message Authentication, Reporting and Conformance, is a DNS record that sets a policy for mail claiming to come from your domain. It builds on SPF and DKIM. A message passes only if SPF or DKIM passes and the passing domain matches the From address a person sees.
That match is called alignment, and it is the point of DMARC. The record, published at _dmarc.yourdomain, also names what receivers should do with failures: nothing (p=none), send to spam (p=quarantine) or refuse (p=reject). It asks for reports on what they saw.
Why it matters
A reject policy is the strongest control a domain owner has against someone sending spoofed mail in your name. It protects customers from fake invoices and password reset lures, and helps stop business email compromise that borrows your domain. Without it, nothing stops a stranger sending mail that looks exactly like yours.
It also affects delivery. Large mailbox providers expect senders of bulk email to publish DMARC. Without one, legitimate campaigns can land in the spam folder and customers stop seeing your messages. The reports show every system sending as you, including forgotten tools, which makes it a useful inventory as well as a control.
How it shows up
Roll it out in stages. Publish p=none with a reporting address, read the aggregate reports for a few weeks, fix every legitimate sender that fails alignment, then move to quarantine and finally reject. Moving too fast blocks your own invoices and password resets.
The usual mistakes: stopping at p=none forever, so nothing is enforced; forgetting a third-party service that sends in your name; ignoring the reports; and not covering subdomains. Parked domains that never send mail should have a reject policy from the start.
Questions people ask
DMARC, answered
What does p=none mean?
It is monitor mode. Receivers do not change how they treat failing mail, but they send reports. It is the right starting point, and a poor place to stay.
Move on once the reports are clean.
What is DMARC alignment?
The domain that passed SPF or DKIM has to match the domain in the visible From address. Without alignment, an attacker could pass SPF using their own domain while showing yours.
Alignment can be strict or relaxed.
Do we need both SPF and DKIM for DMARC?
Only one has to pass with alignment, but you should set up both. Forwarding commonly breaks SPF and message edits can break DKIM, so having both keeps real mail flowing.
Publish both for every sending service.
What are DMARC reports?
Aggregate reports are daily XML summaries from receivers showing which servers sent mail as your domain and whether they passed. Tools can turn them into readable dashboards.
They reveal unknown senders.
Is DMARC required?
Not by law in general, but large mailbox providers require it for bulk senders, and some standards and customers expect it. It is also the standard fix for domain spoofing.
Check your own sector rules.
Sources
Where this comes from
Related
Terms that sit next to this one
SPF
A DNS record listing which servers may send email for your domain.
DKIM
A signature on outgoing email that proves it came from your domain and is unaltered.
Email spoofing
Sending email that appears to come from your domain when it does not.
Business email compromise
Fraud using a hacked or faked work email to redirect payments or data.
BIMI
A standard that shows your logo beside authenticated email in some inboxes.
Which senders fail alignment today?
DMARC is mail and DNS setup, which sits outside our tests. Where your product sends email, we check the web app and API, including cross-account access and password reset logic. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.