How DMARC Works
DMARC passes when SPF or DKIM passes for a domain that aligns with the visible From domain. The receiver then applies the domain owner’s requested policy to messages that fail and may send reports back to the owner.
DMARC Alignment With SPF and DKIM
SPF aligns when the envelope sender domain matches the From domain, and DKIM aligns when the d= signing domain matches it. Relaxed alignment, the default, accepts a match at the organizational-domain level, so mail.example.com aligns with example.com. Strict alignment requires the exact same domain. The aspf and adkim tags set the mode for each check.
DMARC vs DKIM vs SPF
SPF authorizes the servers that may send for an envelope domain, and DKIM adds a cryptographic signature tied to a signing domain. Neither one checks the From address that readers see. DMARC adds that link and the policy, so it depends on at least one of the other two working.
DMARC Record Example
A DMARC record is one TXT record such as v=DMARC1; p=none; rua=mailto:reports@example.com, published at _dmarc.example.com. The table below lists the tags you will meet most often.
DMARC TXT Record
Publish exactly one TXT record at the _dmarc name in the authoritative DNS for the domain. If a receiver finds several DMARC records at that name, it applies no DMARC policy at all. A reporting address at a different domain may need an authorization record at that domain before receivers send reports to it.
DMARC Tags in RFC 9989
RFC 9989 supersedes RFC 7489 as the DMARC specification. It adds the t, np and psd tags and removes the historic pct sampling tag. Guides that still recommend pct describe the previous version.
| Tag | Purpose | Example |
|---|---|---|
| v | Version | DMARC1 |
| p | Requested policy | none, quarantine, reject |
| rua | Aggregate reports | mailto:reports@example.com |
| adkim / aspf | Alignment mode | r or s |
| sp | Subdomain policy | reject |
| np | Policy for non-existent subdomains | reject |
DMARC Policies: None, Quarantine and Reject
The p tag requests one of three policies: none for monitoring only, quarantine to treat failing mail as suspicious, or reject to refuse it. Receivers can still apply local policy, so the tag is a request rather than a guaranteed outcome.
DMARC Quarantine vs Reject
Quarantine usually sends failing messages to the spam or junk folder, while reject asks the receiver to refuse them during delivery. Reject gives stronger protection against direct spoofing but leaves no copy that a recipient can recover. Many domains spend some time at quarantine before they move to reject.
Moving to DMARC Enforcement
Start with p=none, collect aggregate reports and list every service that sends mail for the domain. Fix SPF or DKIM alignment for each legitimate sender before you raise the policy. No fixed schedule fits every organization, so move when the reports show that legitimate mail passes.
How to Read DMARC Reports
Aggregate reports, sent to the rua address, are XML files that summarize which IP addresses sent mail using your domain and whether those messages passed SPF, DKIM and DMARC. Read them to find legitimate senders that still fail alignment and unknown sources that may be spoofing you.
What Is a DMARC Aggregate Report?
Each aggregate report covers a reporting period, often one day, and groups results by source IP address. It lists message counts, the policy applied and the SPF and DKIM domains that were evaluated. Availability and timing vary by receiver, and the raw XML is easier to read with a parser. Failure reports, requested with ruf, can contain message details and many receivers do not send them.
Frequently Asked Questions
Can DMARC Work Without DKIM?
Yes. A message can pass DMARC through aligned SPF alone. SPF often fails when mail is forwarded, while an aligned DKIM signature usually survives forwarding, so most domains should use both.
Can DMARC Prevent Spoofing?
A quarantine or reject policy helps stop direct spoofing of your exact domain in the From address at receivers that honor it. It does not stop look-alike domains, display-name tricks or mail sent from compromised accounts. Treat it as one layer of domain protection.
How Many DMARC Records Can a Domain Have?
A domain should have exactly one DMARC record at its _dmarc name. If a receiver finds more than one, it applies no DMARC policy. Subdomains without their own record fall back to the organizational domain’s record, where the sp tag can set a separate subdomain policy.
Is DMARC Necessary?
DNS does not require it, but major mailbox providers now expect it. Since 2024, Gmail and Yahoo have required bulk senders to publish a DMARC record, and a p=none policy meets that baseline. The reports also show you who sends mail using your domain.