What is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds on SPF and DKIM to give domain owners control over how unauthenticated emails are handled.
How DMARC Works
DMARC ties SPF and DKIM together by requiring "alignment" - the domain in the From header must match the domain authenticated by SPF or DKIM. It also lets domain owners specify what to do with emails that fail authentication.
The DMARC Check Process
- 1Email arrives and SPF/DKIM checks are performed
- 2Server checks if either SPF or DKIM passes AND aligns with the From domain
- 3Server looks up the DMARC policy in DNS
- 4If authentication fails, the policy determines what happens (none, quarantine, reject)
Key Point: DMARC requires alignment - the domain in the visible "From" address must match the domain authenticated by SPF or DKIM.
DMARC Results
Either SPF or DKIM passed with proper domain alignment.
Neither SPF nor DKIM passed with alignment. The policy determines the action.
No DMARC record exists for the domain.
DMARC Policies
p=noneMonitor mode. Take no action on failures, just send reports. Use this when starting out.
p=quarantineSoft enforcement. Send failing emails to spam/junk folder. Intermediate step.
p=rejectFull enforcement. Reject emails that fail DMARC. Maximum protection.
Example DMARC Record
This record quarantines 100% of failing emails and sends aggregate reports to [email protected].
DMARC Record Tags
v- Version (always "DMARC1")p- Policy (none, quarantine, reject)rua- Aggregate report destinationruf- Forensic report destinationpct- Percentage of emails to apply policy tosp- Subdomain policyadkim- DKIM alignment mode (strict/relaxed)aspf- SPF alignment mode (strict/relaxed)
Implementing DMARC
Recommended Approach
- 1Set up SPF and DKIM first
- 2Start with
p=noneto monitor - 3Review reports and fix any issues
- 4Move to
p=quarantine - 5Finally enforce with
p=reject
Why DMARC Matters
- Prevents domain spoofing and phishing
- Gives visibility through reporting
- Improves email deliverability
- Required by many email providers (Google, Yahoo require it for bulk senders)
- Protects your brand reputation
Check Your DMARC Configuration
Use our free spam checker to verify your DMARC policy is working correctly.
Check Your EmailNeed DMARC verification in your app?
Mailhooks checks SPF, DKIM, and DMARC alignment on every inbound email and delivers the full authentication results via webhook.
Try Mailhooks free