DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS-published policy that:
- Requires SPF or DKIM to align with the From: header domain
- Tells receiving servers what to do when alignment fails (
none,quarantine,reject) - Sends aggregate reports back to domain owners showing who sends email on their behalf
DNS Record
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Policy Levels
| Policy | Effect |
|---|---|
p=none | Monitor only — no enforcement |
p=quarantine | Failing email → spam folder |
p=reject | Failing email → rejected entirely |
Why It Matters
Without DMARC, anyone can forge your From: header. SPF checks the invisible envelope sender; DKIM checks the signing domain — neither protects what users see. DMARC alignment is what connects authentication results to the From: address, closing the spoofing gap. p=reject is the end goal for any domain serious about protecting its brand.
Related
Read what DMARC does in depth, check the DKIM and SPF glossary entries, or learn how to read a DMARC aggregate report.