Authentication and DNS
DMARC
DMARC is a rule you publish in your domain's DNS. It tells receiving servers what to do with an email that claims to be from your domain but fails SPF and DKIM. It also tells them where to send you reports.
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a rule you publish in DNS. DNS is the public directory where a domain lists its settings. The rule answers one question for receiving servers. What should happen to an email that uses your domain in the From address but fails the checks?
The From address is the sender address people see in their inbox. Without DMARC, anyone can put your domain there. With DMARC, you can ask Gmail, Outlook.com and other providers to send such emails to spam or block them. You can also ask them to send you reports about every server that sends email in your name.
An example: a fake invoice from billing@example.com
Example Ltd sends its real invoices from billing@example.com. A scammer wants to trick its customers. Here is what happens.
- The scammer sends an email from their own server. The From address says billing@example.com. The subject says "Invoice overdue, pay today".
- The email reaches Tom, one of the company's customers.
- Tom's email provider runs two checks. SPF checks whether the sending server is allowed to send for example.com. It is not. DKIM checks for a valid signature from example.com. There is none.
- The provider looks up the DMARC record of example.com. The record says
p=reject. - The provider blocks the email. Tom never sees it.
Without a DMARC record, step 4 finds nothing. The provider then decides on its own, and the fake invoice might reach Tom's inbox.
Receivers treat your policy as a request. They can also apply their own spam filters next to it.
How DMARC decides: alignment
SPF and DKIM each check a domain. But this domain can be different from the one in the From address. A scammer can pass SPF for their own domain, such as scam-mail.example, while the From address shows example.com.
DMARC adds one rule to fix this. SPF or DKIM must pass for the same domain that appears in the From address. This match is called alignment. Only one of the two checks needs to pass and match. The DMARC alignment page explains the relaxed and strict versions of this rule.
The three DMARC policies
The policy is the p= part of the record. It has three possible values.
| Policy | What happens to an email that fails DMARC | When to use it |
|---|---|---|
p=none | It is delivered as normal. You only get reports. | At the start, while you find all your senders |
p=quarantine | It goes to the spam folder. | When all your real senders pass |
p=reject | It is blocked and never reaches a mailbox. | When you are sure no real email fails |
A simple DMARC record
A DMARC record is a DNS TXT record at the name _dmarc. For example.com, it sits at _dmarc.example.com. Here is a simple record:
v=DMARC1; p=none; rua=mailto:reports@example.comIt has three parts, separated by semicolons.
v=DMARC1says this is a DMARC record. It must come first.p=noneis the policy. Here it says: do nothing special, only report.rua=mailto:reports@example.comis the address that receives the daily summary reports.
A domain may have only one DMARC record. If a receiving server finds two, it ignores both. The guide what is a DMARC record explains every other tag and how to read the reports.
How to start with DMARC
Most domains move up in three steps.
- Publish a record with
p=noneand aruaaddress. Nothing changes for your email, and the reports start arriving. - Read the reports. They list every server that sends email as your domain. Make sure each real service passes SPF or DKIM for your domain. Your newsletter tool and your help desk are two examples.
- Move to
p=quarantine. When no real email goes to spam, move top=reject.
The standard says getting every real sender to pass can take many months. Services that send rarely, such as billing tools, are easy to miss. Our DMARC generator builds the record for each step.
Before you use p=reject, make sure all your email is signed with DKIM. Forwarding breaks SPF. A reject policy that depends on SPF alone can block real forwarded email.
Who requires DMARC
Google's sender guidelines require a DMARC record from senders of 5,000 or more emails a day to personal Gmail accounts. Microsoft has the same rule for Outlook.com, Hotmail and Live. It started enforcing it on 5 May 2025. For both, p=none meets the minimum. The From domain must also align with SPF or DKIM.
The current DMARC standard is RFC 9989, published in May 2026. It replaced RFC 7489. Records that start with v=DMARC1 keep working.
DMARC and email verification
DMARC protects your domain from people who send email in your name. It does nothing about the addresses on your own list. An email to a mailbox that no longer exists bounces, even when it passes DMARC. An email checker finds those addresses before you send, and a bulk email verifier finds them in a full list. With email verification your bounce rate stays low, and DMARC stops scammers from using your domain.
Related terms
- SPF recordAn SPF record is a line of text on your domain that lists the servers allowed to send email for that domain. Receiving servers check it to confirm that an email claiming to come from your domain was sent by one of your servers.
- DKIMDKIM stands for DomainKeys Identified Mail. It adds a digital signature to every email you send. The receiving server checks the signature to confirm the email came from your domain and was not changed after it was sent.
- Email spoofingEmail spoofing is sending an email with a fake sender address, so it looks like it came from someone else. Scammers use it to pose as a bank, a supplier or your own manager. SPF, DKIM and DMARC are the records that stop it for a domain.
- BIMIBIMI is an email standard that shows your brand logo next to your emails in inboxes that support it. It stands for Brand Indicators for Message Identification. It only works when your domain passes DMARC with a quarantine or reject policy.
- DNS TXT recordA DNS TXT record is a line of text stored in your domain's settings. Mail servers read TXT records to check SPF, DKIM and DMARC. Other services read them to confirm that you own the domain.