What is DMARC?

The problem it solves

The From address in an email is just text. Without DMARC, anyone can send a message that shows your domain there, and receivers have no instruction from you about what to do with it. That's how invoice fraud and phishing in your name work.

How it decides

A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the From domain. This matching is called alignment. With relaxed alignment, a subdomain like mail.yourcompany.com counts as a match for yourcompany.com.

The three policies

• p=none changes nothing about delivery. You receive reports and learn who sends as you.
• p=quarantine asks receivers to put failing mail in spam.
• p=reject asks receivers to refuse failing mail outright. This is full protection.

Since 2024, Google and Yahoo require a DMARC record from bulk senders, and Microsoft followed in May 2025. A record with p=none meets the minimum, but only enforcement actually protects your domain.

One record only

A domain must publish exactly one DMARC record at _dmarc. With two, receivers ignore both. If a tool or your DNS host created one for you, edit it instead of adding another.

Reports

The rua tag tells mailbox providers where to send daily aggregate reports: XML files listing which servers sent mail as your domain and whether they passed. Reading them is how you find the services you forgot to set up before tightening the policy.

Check your current record with the DMARC checker or build one with the DMARC generator.