DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy that tells receiving mail servers what to do when an email fails SPF or DKIM checks (nothing, quarantine or reject), and sends reports showing who's sending email using your domain.
Why it matters
- Protects your brand from phishing and spoofing
- Is required for Gmail and Yahoo bulk senders (at least
p=none) - Gives visibility into every service sending as your domain
Alignment
DMARC checks that the visible From domain matches the domain authenticated by SPF or DKIM. Sending as [email protected] through a service that signs as another domain fails alignment.
Policies
| Policy | Effect |
|---|---|
p=none |
Monitor only; collect reports |
p=quarantine |
Failing mail goes to spam |
p=reject |
Failing mail is blocked |
Start with none, fix any legitimate failures, then tighten.
Example record
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]
Example
A company's DMARC reports reveal an old invoicing tool sending unauthenticated mail. It fixes that tool's DKIM before moving to p=reject.
Questions first? Chat with us on WhatsApp