What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that lets a domain owner tell receiving servers what to do with emails that fail SPF or DKIM checks and are not aligned with the sender address, and receive authentication reports. It is published as a TXT record in the domain's DNS.

Last updated: 20 October 2026View as Markdown

In short

DMARC is a policy layer built on top of SPF and DKIM: those two authenticate the message, while DMARC requires the result to align with the visible From domain and says what should happen to messages that fail. It makes spoofing and phishing harder and supports deliverability; since February 2024, Gmail and Yahoo have required bulk senders to publish one. Most teams start at p=none, read the rua aggregate reports, and move to quarantine, then reject, once every legitimate sender is aligned.

Key points

DMARC is a policy standard that requires SPF or DKIM results to align with the visible sender domain.
The record is published as a DNS TXT record at the _dmarc subdomain.
p=none only reports, p=quarantine sends mail to spam and p=reject refuses it.
The rua tag sets the address that receives aggregate authentication reports.
Since February 2024, Gmail and Yahoo have required a DMARC record from bulk senders.

Policies

Policy	What happens
`p=none`	Reported only
`p=quarantine`	Sent to the spam folder
`p=reject`	Rejected

The DMARC record lives at _dmarc.yourdomain.com; the rua tag sets the address that receives aggregate reports. The recommended path is to start with p=none and tighten the policy once you have read the reports.

Why it matters

It makes it harder for your domain to be used in spoofed emails. Since February 2024, Gmail and Yahoo have required a DMARC record from bulk senders. More detail: What are DMARC, SPF and DKIM, audit: email deliverability.

Last updated: 20 October 2026