← Glossary

Protocols & Acronyms

DMARC (Domain-based Message Authentication, Reporting and Conformance)

Also: Domain-based Message Authentication, Reporting and Conformance · v=DMARC1 · p=reject · p=quarantine · p=none · DMARC alignment

Last reviewed:

In one sentence

DMARC is the DNS policy that tells receivers what to do with mail that fails SPF and DKIM alignment against the visible From: domain, and where to send reports about who is sending as you.

Why it matters

SPF and DKIM each verify a domain — but not necessarily the domain the recipient sees. SPF checks the envelope sender; DKIM checks whatever domain signed. A phisher can pass both using their own domain while the From: header says ceo@example.com. DMARC adds the missing rule: at least one of the two must pass and its domain must align with the From: domain. Then it lets the domain owner say what should happen when that fails.

It is the control that actually stops exact-domain spoofing, which is why Google, Yahoo and Microsoft now require it from bulk senders, why PCI DSS assessors and cyber-insurers ask for it, and why the reporting half is the cheapest visibility you will ever get into who is sending mail with your name on it.

How a policy reads

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; sp=reject; pct=100; adkim=s; aspf=r;
                            rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-fail@example.com"
  • p= the policy for the domain: none (monitor only), quarantine (spam folder), reject (bounce). sp= the policy for subdomains, which otherwise inherit p=.
  • adkim= / aspf= alignment mode: relaxed accepts an organisational-domain match (mail.example.com aligns with example.com); strict requires an exact match.
  • pct= apply the policy to this percentage of failing messages — the dial for a gradual rollout.
  • rua= where to send aggregate reports: daily XML from every participating receiver listing sending IPs, message counts and pass/fail per mechanism. ruf= forensic reports with redacted samples of individual failures (few receivers send them).

The evaluation order at the receiver: find the From: domain, look up _dmarc. of it (or of its organisational domain), evaluate SPF and DKIM, check alignment for each, and if neither passes aligned, apply the policy. The verdict goes into Authentication-Results as dmarc=pass or dmarc=fail (p=quarantine).

Try it yourself hands-on

You published p=none with a rua= address two weeks ago and now have a folder of .xml.gz attachments from google.com, outlook.com and others. Nobody has opened one.

  1. Drop one into the DMARC Report Analyzer. It parses the XML in your browser and shows one row per sending source: IP, message count, SPF and DKIM results, and whether each was aligned. A typical first report for a mid-size domain: 
    203.0.113.10   1 240   spf=pass (aligned)   dkim=pass (aligned)   → pass       your mail server
198.51.100.55    310   spf=pass             dkim=pass (aligned)   → pass       marketing platform
192.0.2.77        12   spf=fail             dkim=none             → fail       ?
192.0.2.130        4   spf=fail             dkim=none             → fail       ?
  2. The two fail rows are either forgotten legitimate senders (the old ticketing system, a colleague's personal SMTP) or spoofing. Look up each IP; a legitimate one gets added to SPF or given a DKIM selector via the Email Auth Record Builder. An unknown one is exactly what p=reject is for.
  3. Once a couple of weeks of reports show only your own sources passing, tighten in steps: p=quarantine; pct=25, then 100, then p=reject. The builder emits each record; the Email Security Checker confirms it published.
  4. Check the wider posture in one pass with the Domain Security Posture Scanner: it grades DMARC together with SPF, MTA-STS, DNSSEC and the rest, which is the view an insurer's scan gives you.

Common misreadings

  • p=none is not protection. It is the monitoring stage. Thousands of domains have sat on it for years; the phishers have noticed.
  • Mailing lists break DMARC (they rewrite the message, killing DKIM, and resend from their IP, killing SPF). Lists that honour DMARC rewrite the From: header; ARC (RFC 8617) is the longer-term fix.
  • Parked domains need DMARC too. A domain that never sends mail should publish v=spf1 -all and v=DMARC1; p=reject, otherwise it is the easiest one to spoof.