Skip to content
mailprompt
Start free trial
GlossaryUpdated

What is DMARC?

DMARC is an email authentication policy that tells a receiving server what to do when a message fails SPF or DKIM alignment, and where to send reports. It is published as a TXT record at _dmarc. A monitoring policy collects data; quarantine and reject begin enforcement.

Key facts

  • DMARC.org describes a policy that tells receiving servers how to handle mail that fails authentication and where to send reports. Source
  • Google requires bulk senders to publish a DMARC record and keep a policy in place. Source
  • DMARC.org describes a progression from monitoring to quarantine and then to reject as confidence grows. Source

What DMARC is

This definition is part of the Mailprompt glossary. DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a policy record that tells a receiving server how to treat a message that fails SPF or DKIM alignment with the From domain.

It is not a replacement for SPF or DKIM. It is the layer that ties them together and gives the domain owner a report. Without DMARC, a receiver can still check SPF and DKIM, but it has no explicit instruction about what to do when they fail.

Alignment is the key idea

SPF checks the envelope sender. DKIM checks a signature. DMARC asks whether either result aligns with the domain in the visible From address.

A message can pass SPF for a third-party domain and still fail DMARC because the domains do not align. A message can pass DKIM for a third-party domain and fail the same way. Alignment is what connects the authentication result to the brand the recipient sees.

The policy values

A DMARC record contains a policy value. p=none asks for monitoring. p=quarantine asks the receiver to treat failing mail with suspicion, often by placing it in spam. p=reject asks the receiver to refuse it.

The record can also set a percentage, an alignment mode and reporting addresses. A percentage below one hundred is useful during a gradual rollout. The alignment mode controls whether strict or relaxed matching applies to SPF and DKIM.

Reports

The rua tag names the address that receives aggregate reports. Those reports show which sources sent mail for the domain, how many messages they sent and whether they passed authentication.

The reports are not a dashboard. They are XML files that need a tool or a process to read. A report address nobody monitors is worse than no reports, because it creates the appearance of monitoring without the benefit.

Moving to enforcement

DMARC.org describes a progression from monitoring to quarantine and then to reject. The order matters. A reject policy on a domain with an unknown sender can block legitimate mail.

The safe sequence is to collect reports, confirm that every known sender passes authentication and alignment, then move to quarantine for a period, then to reject. Each step should be followed by a review of the reports.

  • SPF authorizes the sending servers.
  • DKIM signs the message.
  • Deliverability is the outcome the policy supports.

Frequently asked questions

What does p=none mean?

A p=none policy is a monitoring policy. It asks the receiving server to report authentication results without rejecting or quarantining mail that fails. It is the usual first step for a domain with several senders, because it reveals who is sending before enforcement begins.

Do I need DMARC if I already have SPF and DKIM?

SPF and DKIM are authentication mechanisms. DMARC is the policy that ties them to the From domain and tells the receiver what to do when they fail. Without DMARC, a receiver has less guidance and the domain owner gets no aggregate reports. The three work together.

Where do DMARC reports go?

The rua tag in the DMARC record names the address or addresses that receive aggregate reports. The reports are XML summaries of sending sources and authentication results. The ruf tag can request forensic reports, but many receivers do not send them. Use an address your team actually monitors.

Sources