DMARC (Domain-based Message Authentication)

DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a policy published in DNS. It tells receivers how to treat mail whose visible From domain does not pass SPF or DKIM with a matching (aligned) domain, and where to send reports.

Why it matters

SPF and DKIM alone do not require the checked domain to match the From address people see. DMARC adds that requirement, which is what actually blocks spoofing of your brand. The reports show every service sending as your domain, which is how you find forgotten senders before enforcing. Major mailbox providers have also tightened expectations for bulk senders to publish DMARC, so check current provider requirements.

Example

_dmarc.example.com.  3600 IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

p is the policy (none, quarantine or reject), rua is where aggregate XML reports go, and adkim/aspf set relaxed or strict alignment.

Common mistakes

• Jumping to p=reject without reading reports first and blocking legitimate senders.
• Staying on p=none indefinitely, which monitors but protects nothing.
• Putting the record at the wrong name. It must be at _dmarc.<domain>.
• Using a rua address in another domain without that domain authorizing reports.

Related

• BIMI
• TXT record
• Email bounce
• Guide: DMARC rollout: none, quarantine, reject
• Tool: SPF and DMARC generator

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.