What is DMARC?

DMARC is a policy published in DNS that tells receiving mail servers what to do with messages that fail SPF and DKIM checks for your domain, and where to send reports about them.

The record is a TXT record at _dmarc.yourdomain. A message passes DMARC if SPF or DKIM passes and the domain that passed is aligned with the domain in the visible From header. Alignment is the point: it ties the technical checks to the address the recipient actually sees, which is what phishing imitates.

The p= tag sets the policy: none (only monitor), quarantine (treat as suspicious, usually the spam folder) or reject. rua= names the mailbox for aggregate reports, which receivers send daily as XML summaries of who is sending mail with your domain. sp= sets a separate policy for subdomains, and adkim and aspf switch alignment between relaxed and strict.

The usual path is to start at p=none, read the reports until every legitimate sender passes with alignment, then move to quarantine and finally reject. Large mailbox providers now expect bulk senders to have a DMARC record. A policy of reject is an instruction to receivers, not a guarantee: each receiver decides how to apply it.

Example

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=r"

Check it

See how DMARC looks for a real domain:

DMARC checker