Guides DMARC
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the manager that brings together the SPF and DKIM results and attaches a decision to them. It does three things: it decides what receivers should do with mail that fails the checks, it requires a passing check to belong to your visible sender (called 'alignment'), and it sends you reports so you can see who's mailing for your domain. Only with DMARC is your visible From address truly protected from abuse.
How does DMARC work?
You publish a TXT record at _dmarc.<domain>. When a mail arrives, the receiver first checks SPF and DKIM. Then it sees whether the passing domain 'matches' your visible sender (the From you see in your mail app). If neither gets a matching check, the receiver applies your DMARC policy. Ask for reports and it sends those along too.
Example: v=DMARC1; p=reject; rua=mailto:dmarc@example.com. Here you say: 'reject mail that fails the checks, and send the reports to this address'.
The record piece by piece
p=: the policy, sonone(just watch),quarantine(send to spam) orreject(refuse)rua=: the email address where the (daily) summary reports gosp=: a separate policy for subdomainsadkim=/aspf=: how strict the 'match' must be,r(relaxed, the default) ors(strict)pct=: what percentage of mail the policy applies to (handy for a gradual rollout, but note: not every receiver honors it)
What is 'alignment'?
DMARC only passes if the passing SPF or DKIM check belongs to the domain in your visible sender. That's where it goes wrong most often in practice. Your newsletter tool, for instance, passes SPF just fine, but for its own domain. If that doesn't belong to yours, the pass doesn't count and your own newsletter gets hit by your own policy.
In the default 'relaxed' mode the same root domain suffices: mail.example.com then matches example.com. In 'strict' mode it must be exactly equal. That's why a mail can pass SPF/DKIM and still fail DMARC.
Why you need this
SPF and DKIM look at other domains (the envelope address, the signing domain). Only DMARC protects the address your recipients actually see: your visible From. To stop scammers from putting your brand in the sender field, a strict policy (p=reject) is the only real solution.
A policy of quarantine or reject is also a prerequisite for BIMI (your logo next to the sender in the inbox), and large mailbox providers now genuinely require it: Gmail and Yahoo (since 2024) and Microsoft/Outlook.com (since 2025) demand a DMARC record from bulk senders, at least p=none.
Growing to 'reject' safely
Don't set DMARC to reject straight away: you could block your own legitimate mail without noticing. Build it up calmly:
- Start with
p=noneand arua=address, and collect a few weeks of reports - Map all legitimate senders and make sure they're 'aligned'
- Move to
p=quarantine, optionally with a lowpct=for a gradual rollout - Check the reports for unexpected failures
- Finally set it to
p=rejectonce everything arrives cleanly
Reading the reports
The rua reports are XML files receivers send daily. Per sending IP address you see how much mail there was and whether SPF/DKIM/DMARC passed. No message content, so it's privacy-friendly. Because raw XML is hard to read, many people use a (often free) reporting service that turns the data into a clear overview.
That way you quickly spot whether unknown senders are mailing for you, or a service of your own isn't set up right yet. That's handy before you move to reject.
Frequently asked questions
What is alignment?
DMARC requires the SPF or DKIM domain to match the organizational domain of your visible From. So an SPF pass for a different domain doesn't automatically count.
Does DMARC cover subdomains?
Yes. If a subdomain has no record of its own, the organizational domain's policy applies (or its sp= value). DNS Radar follows that inheritance automatically.
Is p=none useful?
For monitoring, yes: you get reports without blocking any mail. But p=none offers no protection against spoofing: receivers do nothing at all with a failed check. For that you eventually need quarantine or reject.
Why does legitimate mail sometimes fail DMARC?
Forwarding often breaks SPF, and mailing lists modify the message which breaks DKIM. ARC can preserve that context. So read your reports before moving to reject.
Do I need DMARC for BIMI?
Yes. BIMI (your logo next to the sender) requires a DMARC policy of at least quarantine, and in practice usually reject.