The short version

Anyone can put your domain in the From line of an email. DMARC is the record that lets receivers tell your real mail from the rest. It does two things: it asks receivers to check that each message passed SPF or DKIM for your domain, and it tells them what to do when one doesn’t. It also asks them to send you daily reports of who sent mail as your domain.

What a DMARC record looks like

It’s a TXT record at _dmarc under your domain:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
  • v=DMARC1 says it’s a DMARC record.
  • p= is the policy: what to do with mail that fails.
  • rua= is where to send the aggregate reports.

The three policies

Policy What receivers do with failing mail
p=none Deliver it as usual, and report it. Monitoring only.
p=quarantine Put it in the junk folder.
p=reject Refuse it.

p=none is where everyone starts, because the reports show you every service sending as your domain before anything is blocked. It doesn’t protect you: spoofed mail is still delivered. The usual path is quarantine by day 30 and reject from day 60, each step tested first with t=y; see how to publish a DMARC record.

What “passing” means: alignment

DMARC passes when SPF or DKIM passes and the domain it passed for matches the domain in the From address. That match is called alignment.

  • SPF checks the envelope sender (the bounce address), which is often the sending service’s domain, not yours.
  • DKIM checks a signature, whose d= domain is often the service’s too, until you set it up with yours.

So a message can pass SPF and DKIM and still fail DMARC: both passed, for someone else’s domain. That is the most common surprise in a rollout.

The reports

Mailbox providers send an aggregate report, usually once a day, to your rua= address. Each one lists the servers that sent mail as your domain, how many messages, and whether SPF, DKIM and DMARC passed. They’re XML, built for machines; the XML-to-human Converter turns one into a table, and DMARCLoop reads them all for you and names the senders.

Why it matters now

Gmail, Yahoo and Microsoft require DMARC from bulk senders, and since November 2026 Outlook.com has refused some mail from domains with no DMARC record at any volume; see why Outlook.com is rejecting mail without DMARC. The current specification is DMARCbis, RFC 9989; see what DMARCbis changed.

Next steps

  1. Check what your domain has now with the Domain Checker.
  2. Build a record with the DMARC Record Wizard.
  3. Read the reports, fix your senders, then tighten the policy.