Definition
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that helps domain owners prevent unauthorised use of their domain in email. It builds on SPF and DKIM by adding a policy that tells receiving mail servers how to handle messages that fail authentication, and provides reporting that helps domain owners monitor authentication activity.
DMARC is the third layer of email authentication, sitting on top of SPF and DKIM. Without DMARC, SPF and DKIM alone cannot fully prevent domain spoofing because spammers can use their own infrastructure to send email that appears to come from your domain.
How DMARC Works
- The domain owner publishes a DMARC policy in their DNS as a TXT record
- The policy specifies whether SPF and/or DKIM must pass authentication
- The policy also requires alignment — the domain in the From header must match the domain checked by SPF or DKIM
- When an email arrives, the receiving server checks SPF and DKIM, then checks DMARC alignment
- Based on the published DMARC policy, the server either delivers the email, sends it to spam, or rejects it
- Receiving servers send aggregate and forensic reports back to the domain owner
DMARC Policy Levels
DMARC policies determine what happens when authentication fails:
| Policy | DNS Value | Action | Best For |
|---|---|---|---|
| Monitor | p=none |
Take no action, deliver anyway | Initial setup, monitoring |
| Quarantine | p=quarantine |
Send to spam folder | Transitioning to enforcement |
| Reject | p=reject |
Block delivery entirely | Full protection |
Most security experts recommend starting with p=none to monitor current email flows, then moving to p=quarantine once all legitimate email is authenticated, and finally p=reject for maximum protection.
DMARC Record Format
A DMARC record is a TXT record in DNS:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
| Tag | Description | Example |
|---|---|---|
v= |
DMARC version | DMARC1 |
p= |
Policy | none, quarantine, or reject |
rua= |
Aggregate report URI | mailto:dmarc@yourdomain.com |
ruf= |
Forensic report URI | mailto:forensic@yourdomain.com |
sp= |
Subdomain policy | Same as p options |
pct= |
Percentage of mail to filter | 100 (default) |
adkim= |
DKIM alignment mode | r (relaxed) or s (strict) |
aspf= |
SPF alignment mode | r (relaxed) or s (strict) |
DMARC Alignment
Alignment is what makes DMARC powerful. It requires that the domain in the From header matches the domain checked by SPF or DKIM:
- Strict alignment: The domains must match exactly (
adkim=soraspf=s) - Relaxed alignment: Subdomains are allowed (
adkim=roraspf=r)
Without alignment, a spoofer could use your domain in the From header while using their own sending infrastructure that passes SPF or DKIM.
DMARC Reports
DMARC provides two types of reports sent to the address specified in the rua and ruf tags:
- Aggregate reports (rua): XML summaries sent daily showing authentication results from receiving servers — which messages passed, failed, and how many
- Forensic reports (ruf): Detailed information about individual authentication failures, sent immediately when a message fails
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
AIDA Model for Email
The AIDA model (Attention, Interest, Desire, Action) is a classic copywriting framework used to structure email campaigns that guide subscribers from awareness to conversion.
AMP for Email
AMP for Email is a Google-developed framework that allows email messages to include interactive elements like forms, carousels, accordions, and live content. It turns static emails into dynamic, interactive experiences directly inside the inbox.
Announcement Email
An announcement email is a dedicated campaign that communicates a specific update, milestone, or change to subscribers, from product launches and feature releases to company news and events.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Frequently Asked Questions
Major mailbox providers including Gmail and Yahoo now require DMARC for bulk senders sending over 5,000 messages per day. Even for smaller senders, DMARC improves deliverability by providing a clear authentication policy that receiving servers can follow.
DMARC requires that the domain in the email's From header aligns with (matches) the domain that passed SPF or DKIM. This prevents spammers from using your domain in the From address while sending through their own servers. Alignment is what makes DMARC effective against domain spoofing.
DMARC reports are XML files that can be difficult to read manually. Use a DMARC analysis tool like DMARCian, Validity, MXToolbox DMARC, or Postmark's DMARC tool to parse and visualise the reports. These tools show which IPs are sending on your behalf and whether they are authenticating correctly.
Legitimate email that fails SPF or DKIM will be rejected, meaning your subscribers will not receive it. This typically results in a significant drop in email deliverability. Always monitor reports with `p=none` first, fix any authentication issues, then gradually move to `p=quarantine` and finally `p=reject`.
Any third-party service that sends email on your behalf (Mailchimp, SendGrid, HubSpot, etc.) must be set up to pass SPF or DKIM with alignment. This means their DKIM signatures must use your domain, or your SPF record must include their sending IPs. Most ESPs provide instructions for configuring DKIM to pass DMARC alignment.