What DMARC means
A DMARC record — Domain-based Message Authentication, Reporting and Conformance, RFC 7489 — is a TXT record at _dmarc.example.com beginning v=DMARC1. The tag that decides behaviour is p=: none observes only, quarantine asks the receiver to treat failing mail as suspicious, reject asks it to refuse the message during the SMTP conversation. sp= sets a separate policy for subdomains, pct= applies the policy to a sample of failing mail during a ramp, and adkim= and aspf= choose relaxed or strict alignment.
A message passes DMARC when SPF or DKIM passes and the identifier that passed is aligned with the domain in the header From. One of the two is enough. That sentence is the whole protocol; everything else — the policy, the percentage, the reporting addresses — describes what happens when neither one does.
Every deployment starts at p=none with a rua= address, because the aggregate reports name the sources sending as your domain, including the ones nobody remembered. Moving to quarantine and then to p=reject is safe only once those reports show every legitimate source aligning. A record published straight at p=reject rejects your own mail as efficiently as anyone else's.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.
- DMARC alignment The match that decides whether a pass counts.
- RUA and RUF Where the reports a policy asks for are sent.
- DMARC record checker Parse a published record and read its policy.
- Taking a DMARC policy to enforcement The path from p=none to p=reject and what to check at each step.
- Making sense of DMARC aggregate reports Reading the XML that p=none earns you.