DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS-published policy that:
- Requires SPF or DKIM to align with the From: header domain
- Tells receiving servers what to do when alignment fails (
none,quarantine,reject) - Sends aggregate reports back to domain owners showing who sends email on their behalf
DNS Record
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Policy Levels
| Policy | Effect |
|---|---|
p=none | Monitor only — no enforcement |
p=quarantine | Failing email → spam folder |
p=reject | Failing email → rejected entirely |
Why It Matters
Without DMARC, anyone can forge your From: header. SPF checks the invisible envelope sender; DKIM checks the signing domain — neither protects what users see. DMARC alignment is what connects authentication results to the From: address, closing the spoofing gap. p=reject is the end goal for any domain serious about protecting its brand.