Email authentication

What is DMARC? Domain-based Message Authentication, Reporting and Conformance explained

DMARC ties SPF and DKIM to the visible sender address and defines what happens to forged email: nothing (none), spam folder (quarantine) or rejection (reject).

How DMARC works

SPF and DKIM alone say nothing about the From address the recipient sees. DMARC closes that gap: a message passes DMARC only if SPF or DKIM passes and the verified domain matches the From domain (alignment).

The DMARC record is a TXT record at _dmarc.<domain>. The p= policy applies to the domain, sp= to its subdomains. With rua= you set an address for daily aggregate reports; they show which servers send on your behalf and whether they pass SPF and DKIM.

A gradual rollout works best: start with p=none and reports, set up every legitimate sender correctly, then move to quarantine and finally reject. Since February 2024 Gmail and Yahoo require bulk senders to publish a DMARC record.

Example

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"

Forged mail is rejected, for subdomains too; aggregate reports go to dmarc@example.com.

Common mistakes

Staying on p=none for good – that is monitoring only and does not stop spoofing.
No report address (rua), so misconfigurations go unnoticed.
Reports sent to another domain without an authorisation record (<domain>._report._dmarc.<receiver>) – they are then not delivered.
Several DMARC records or typos such as "v=DMARC1;p=" without a valid value.

How the Domain Trust Check rates DMARC

Criterion “DMARC” (weight 5 of 5): DMARC record at _dmarc, policy p=none/quarantine/reject, percentage (pct), aggregate reports (rua) incl. authorisation of external receivers, subdomain policy (sp) and alignment (adkim/aspf).

Standard: RFC 7489