What Is DMARC and How Does It Work?
DMARC is the policy layer that makes SPF and DKIM enforceable and stops spoofing of your domain. Here's how it works and how to deploy it without blocking your own mail.
TL;DR
DMARC tells receivers what to do when SPF/DKIM fail and sends you reports. Roll out p=none → quarantine → reject gradually. Jumping straight to reject can block legitimate mail.
What DMARC does
DMARC (RFC 7489) builds on SPF and DKIM. It requires alignment (the authenticated domain must match the visible From domain) and lets you publish a policy for failures, plus receive reports about who's sending as you.
The three policies
| Policy | What happens on failure | Use when |
|---|---|---|
| p=none | Monitor only | Initial rollout |
| p=quarantine | Send to spam | After verifying alignment |
| p=reject | Block outright | Fully aligned & confident |
The record
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"The rua address receives aggregate reports showing all sources sending as your domain.
Safe rollout
- p=none — collect reports, discover every legitimate sender.
- Ensure each one passes SPF and/or DKIM with alignment.
- p=quarantine — start enforcing softly.
- p=reject — full protection once nothing legitimate fails.
Why not jump to reject?
If a legitimate service isn't aligned yet, p=reject will block its mail. The phased approach prevents that — a common mistake covered in our 550 block guide.
DMARC and compliance
DMARC is now required under the Gmail/Yahoo sender rules for bulk senders.
AutoPMTA checks DMARC alignment and policy in DNS Health. See pricing.
Key takeaways
- DMARC enforces SPF/DKIM with domain alignment.
- Policies: none (monitor) → quarantine → reject.
- Use reports (rua) to find all legitimate senders.
- Roll out gradually to avoid blocking your own mail.
Frequently asked questions
What is DMARC in simple terms?+
DMARC is a policy that tells receiving servers what to do when an email fails SPF or DKIM checks for your domain, and it sends you reports on who is sending mail as your domain. It prevents spoofing.
What does p=reject mean?+
p=reject is the strictest DMARC policy: receivers block any mail claiming to be from your domain that fails authentication. Only move to it once all legitimate senders pass with alignment.
Should I start DMARC with p=reject?+
No. Start with p=none to monitor and discover all legitimate senders, then move to quarantine, and only adopt reject once nothing legitimate fails — otherwise you risk blocking your own mail.