What is DMARC? How it works, a good record, and how to check yours
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with email that claims to be from you but fails SPF and DKIM: deliver it, send it to spam, or reject it.
It also asks receivers to send you daily reports, so you can see who is sending email with your domain. A good starting record is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
How DMARC works
DMARC builds on SPF and DKIM. It adds one rule: the domain that passed must match the domain in the visible From address. This is called alignment.
- Someone sends an email with
From: you@yourdomain.com. - The receiving server checks SPF (is this server allowed to send for the envelope domain?) and DKIM (is the signature valid, and for which domain?).
- It looks up your DMARC record at
_dmarc.yourdomain.com. - If SPF or DKIM passed and the passing domain aligns with yourdomain.com, the message passes DMARC.
- If both fail alignment, the receiver applies your policy:
none(deliver anyway),quarantine(spam folder) orreject(bounce). - Once a day, receivers like Gmail, Yahoo and Microsoft send an aggregate report to the address in
rua.
Example of a good DMARC record
This record is published as a TXT record with the host name _dmarc:
v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com; adkim=r; aspf=r; pct=100| Tag | Meaning | Example |
|---|---|---|
v | Version. Must be first and must be exactly DMARC1. | v=DMARC1 |
p | Policy for your domain: none, quarantine or reject. Required. | p=reject |
sp | Policy for subdomains. If left out, subdomains use p. | sp=reject |
rua | Where to send daily aggregate reports. Without it you are flying blind. | rua=mailto:dmarc@example.com |
ruf | Where to send failure (forensic) reports. Few providers send these; optional. | ruf=mailto:dmarc@example.com |
pct | Percent of failing mail the policy applies to. Default 100. Use it to ramp up. | pct=25 |
adkim | DKIM alignment: r relaxed (subdomains match, default) or s strict (exact match). | adkim=r |
aspf | SPF alignment: r relaxed (default) or s strict. | aspf=r |
fo | When to send failure reports: 0 if all checks fail (default), 1 if any check fails. | fo=1 |
Common DMARC mistakes
- Publishing it at the wrong name
- The record must be at
_dmarc.example.com, not atexample.com. Many DNS hosts add the domain for you, so the host field should be just_dmarc. - Two DMARC records
- If there is more than one record at
_dmarc, receivers ignore DMARC entirely. Merge them into one. - Staying on p=none forever
p=noneonly monitors. It does not stop anyone from spoofing your domain. Move to quarantine and reject once reports look clean.- No rua address
- Without
ruayou get no reports, so you cannot tell whether it is safe to tighten the policy. - Jumping straight to p=reject
- If a service you use (billing, CRM, newsletter) is not set up for SPF or DKIM, its mail will bounce. Start with
p=noneand read the reports first. - Syntax errors
- Missing semicolons, a typo like
v=DMARC 1, ormailto:left off the rua address all break the record. - Sending reports to another domain without permission
- If
ruapoints to a different domain, that domain must publish an authorization record, or receivers will not send the reports.
How to set up DMARC safely: none, then quarantine, then reject
- Make sure SPF and DKIM pass for every service that sends as your domain: your mailbox provider, newsletter tool, CRM, help desk and billing system.
- Monitor: publish
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1. Leave it for 2 to 4 weeks and read the reports. - Fix what the reports show: any legitimate sender that fails needs SPF or DKIM set up for your domain.
- Quarantine gradually: change to
p=quarantine; pct=25, then 50, then 100, a week or two at each step. - Reject: when nearly all legitimate mail passes, switch to
p=reject. Keep the reports coming so you notice new senders.
DMARC FAQ
Do I need DMARC if I already have SPF and DKIM?
Yes. SPF and DKIM only prove that some domain authorised the message. DMARC checks that this domain matches the From address people see, and tells receivers what to do when it does not. Without DMARC, spoofed mail using your visible From address can still get through.
Is DMARC required by Gmail and Yahoo?
Since February 2024, Gmail and Yahoo require anyone sending 5,000 or more messages a day to their users to publish a DMARC record (p=none is enough), pass SPF or DKIM with alignment, and offer easy unsubscribe. Smaller senders are required to have SPF or DKIM, and DMARC is strongly recommended.
What DMARC policy should I use?
Start with p=none and a rua address so you can see who sends mail as your domain. After fixing any legitimate senders that fail, move to p=quarantine and then p=reject. p=reject gives the strongest protection against spoofing.
Will DMARC stop my own emails from being delivered?
It can if you enforce it too early. With p=quarantine or p=reject, any service that sends as your domain without passing aligned SPF or DKIM will be spam-foldered or bounced. That is why you start with p=none and check the reports first.
Where do I add a DMARC record?
Add a TXT record at your DNS host (often your domain registrar or Cloudflare). Set the host or name field to _dmarc and the value to your DMARC record, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
How long does a DMARC change take to work?
Usually minutes, sometimes up to the record TTL (often 1 hour). Aggregate reports arrive about once every 24 hours, so give it a day before expecting the first report.
What is DMARC alignment?
Alignment means the domain that passed SPF or DKIM matches the domain in the From address. With relaxed alignment (the default), mail.example.com aligns with example.com. With strict alignment, only an exact match counts.
What does pct mean in a DMARC record?
pct is the percentage of failing messages the policy applies to. pct=25 with p=quarantine means a quarter of failing mail goes to spam and the rest is treated as p=none. It is a way to ramp up enforcement. The default is 100.