What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a policy layer built on SPF and DKIM. It tells receiving servers what to do — none, quarantine, or reject — when a message fails authentication for your domain, and sends you reports so you can monitor and stop spoofing.
DMARC adds two things SPF and DKIM lack on their own: alignment and policy. Alignment requires that the domain validated by SPF or DKIM matches the visible "From" domain, closing the spoofing gap. Policy ("p=none", "p=quarantine", or "p=reject") tells receivers how to treat failures.
Best practice is to start at "p=none" to collect reports without affecting delivery, review the aggregate (rua) reports to confirm all legitimate mail passes, then tighten to "p=quarantine" and finally "p=reject" for full protection.
As of 2024, Gmail and Yahoo require a valid DMARC record for bulk senders. A published DMARC policy — even at "p=none" — is now effectively mandatory for reliable inbox placement.
How DMARC works
DMARC is a DNS TXT record published at _dmarc.yourdomain.com. When a receiver gets a message, it checks SPF and DKIM as usual, then applies your DMARC policy: it requires that at least one of them both passes and aligns with the visible From domain. Alignment is the crucial addition — SPF checks the hidden Return-Path and DKIM checks the signing domain, but DMARC insists that one of those matches the From address your recipient actually sees, closing the spoofing gap SPF and DKIM leave open on their own.
If a message fails DMARC (neither SPF nor DKIM passes with alignment), the receiver applies your published policy: p=none takes no action, p=quarantine sends it to spam, and p=reject blocks it. Two alignment modes control strictness: relaxed (the default) allows subdomains to align with the organizational domain, while strict requires an exact match.
DMARC also turns on reporting. The rua tag receives daily aggregate XML reports summarizing how much of your mail passed and failed, and from which sources — this is how you discover forgotten sending services or active spoofing before you tighten policy. The optional ruf tag receives forensic (per-message failure) reports, though many providers no longer send these for privacy reasons.
How to set up DMARC: the p=none → quarantine → reject progression
Start at p=none with reporting enabled. This is monitor-only: it changes nothing about delivery but streams aggregate reports to your rua address so you can see every source sending as your domain. Review those reports until you have confirmed that all your legitimate mail (newsletters, transactional email, helpdesk, third-party tools) passes SPF or DKIM with alignment.
Once legitimate traffic is clean, move to p=quarantine — failing messages now go to spam. You can ease into it with pct=25 to apply the policy to only a quarter of failing mail at first, then raise it to 100. Finally, tighten to p=reject so spoofed mail is blocked outright. Jumping straight to p=reject before verifying your own mail passes is the classic way to bounce your own newsletters.
Common mistakes
The single biggest mistake is leaving DMARC at p=none forever. A monitor-only policy satisfies the "published DMARC" checkbox for Gmail and Yahoo, but it provides zero spoofing protection — anyone can still forge your domain. The point of DMARC is to reach enforcement.
Other pitfalls: publishing DMARC before SPF and DKIM are solid (so your own mail fails alignment), pointing rua at an address you never read (so you tighten policy blind), and forgetting that rua reports on external domains require a special authorization record if the mailbox is on a different domain. Set up SPF and DKIM first, verify alignment in reports, then progress the policy.
Example records
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r
Published as a TXT record at _dmarc.yourdomain.com. p=none monitors without affecting delivery; rua receives daily aggregate reports; adkim/aspf=r sets relaxed alignment.
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s
Move here only after aggregate reports confirm all legitimate mail passes. p=reject blocks spoofed messages; strict alignment (s) requires an exact From-domain match.
DMARC policy effects
| Policy | What receivers do on failure | Spoofing protection | When to use |
|---|---|---|---|
| p=none | Deliver as normal; only report | None (monitor only) | First 2–4 weeks, to collect reports |
| p=quarantine | Send failing mail to spam/junk | Partial | After confirming legitimate mail passes |
| p=reject | Block failing mail outright | Full | Final state — full anti-spoofing enforcement |
Frequently asked questions
What is a DMARC record?
A DMARC record is a DNS TXT record at _dmarc.yourdomain.com that tells receiving servers what to do — nothing, quarantine, or reject — when a message fails SPF and DKIM alignment for your domain. It also enables reporting so you can monitor and stop spoofing of your domain.
Is DMARC required?
Effectively, yes. Since February 2024, Gmail and Yahoo require bulk senders to publish a DMARC policy, and Microsoft added similar rules for Outlook.com in 2025. Even at p=none a published DMARC record is now practically mandatory for reliable inbox placement, and enforcement is strongly recommended.
What does p=none mean in DMARC?
p=none is monitor-only mode. Messages that fail DMARC are still delivered normally, but the receiver sends you aggregate reports showing what passed and failed. Use it as a starting point to verify all legitimate mail aligns, then progress to p=quarantine and p=reject for actual protection.
What is the difference between p=quarantine and p=reject?
p=quarantine sends messages that fail DMARC to the spam or junk folder, while p=reject blocks them outright so they are never delivered. Quarantine is a safer intermediate step; reject is the final state that gives full protection against domain spoofing once you are confident in your setup.
What are rua and ruf in DMARC?
rua is the address that receives daily aggregate reports — summarized XML showing how much mail passed or failed DMARC and from which sources. ruf receives forensic, per-message failure reports, though many providers no longer send these for privacy reasons. rua is the one you rely on to reach enforcement safely.
How do I move from DMARC p=none to p=reject safely?
Start at p=none and review aggregate reports until every legitimate sending source passes SPF or DKIM with alignment. Then move to p=quarantine (optionally using pct= to ramp gradually), confirm nothing legitimate is being caught, and finally set p=reject. Rushing to reject before verifying alignment bounces your own mail.
MailPilot’s free DMARC generator builds a policy record with reporting enabled, and the DNS health checker verifies your SPF, DKIM, and DMARC align correctly.
Generate a DMARC policy →