How DMARC works
DMARC builds on two other standards:
- SPF: lists the servers allowed to send email for your domain.
- DKIM: adds a digital signature that proves an email wasn’t changed on the way.
An email passes DMARC when SPF or DKIM passes and matches the domain in the From address. Your DMARC policy, published as a TXT record in your DNS, says what should happen to emails that fail:
p=none: deliver as usual, but report (a good starting point).p=quarantine: send to the spam folder.p=reject: block the email.
Why DMARC matters
It stops criminals from sending phishing emails in your name, and it improves the delivery of your own emails. Since 2024, Gmail and Yahoo require a DMARC record from bulk senders, and a DMARC policy of quarantine or reject is needed before your logo can appear in inboxes through BIMI.
Example record: v=DMARC1; p=quarantine; rua=mailto:[email protected]
DMARC example
A company’s customers receive emails that seem to come from “[email protected]” but are fake. The company publishes SPF and DKIM, then adds a DMARC record with p=none and a report address. For a few weeks, the reports show every system that sends email for the domain, including a forgotten survey tool. After fixing it, the company changes the policy to quarantine and later to reject. Spoofed messages stop reaching inboxes.
DMARC rollout steps
- List every service that sends email using your domain.
- Set up SPF and DKIM for each one.
- Publish a DMARC record with p=none and a report address (rua).
- Read the reports for a few weeks and fix failures.
- Move to p=quarantine, then p=reject, when legitimate mail passes.
- Keep checking the reports after changes.
DMARC mistakes
- Jumping to p=reject without checking all senders, which blocks real email.
- Leaving p=none for years, so nothing is protected.
- Forgetting subdomains.
- Sending bulk email from your domain without the required authentication.
DMARC FAQs
Why does DMARC matter for marketers?
Large mailbox providers expect bulk senders to authenticate their email. Without it, newsletters may land in spam. See email marketing and BIMI.
Where do I set it up?
As a TXT record in your DNS. See DNS.