Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

DMARC

Domain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.

Sumit Raj · reviewed

Domain-based Message Authentication, Reporting and Conformance. The only one of the three records that looks at the From address a recipient actually sees.

DMARC passes when SPF or DKIM passes and the domain it passed for aligns with the From domain. Either is sufficient. Both failing triggers the published policy: none, quarantine or reject.

p=none is reporting without protection. A domain left there is exactly as spoofable as a domain with no DMARC record.

DMARC governs your exact domain only. It does nothing about a lookalike registration, and nothing about a display name reading as your company with a webmail address behind it.

Related

  • SPFSender Policy Framework: a DNS TXT record listing the servers authorised to send mail using a domain in the SMTP envelope sender. Defined in RFC 7208.
  • DKIMDomainKeys Identified Mail: a cryptographic signature added to outgoing messages and verified against a public key published in the sending domain's DNS. Defined in RFC 6376.
  • DMARC alignmentThe DMARC requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header, either exactly (strict) or allowing subdomains (relaxed). Defined in RFC 9989 section 4.4.
  • p=rejectThe DMARC policy instructing receivers to refuse messages that fail authentication for the From domain, rather than delivering or quarantining them. Defined in RFC 9989 section 4.7.
  • What is DMARC?The only email record that looks at the address your recipient actually sees, and the only one that stops somebody sending in your name.
  • DMARC, from a first record to enforcementThe only record that governs the address your recipient actually sees. What it does, what it does not, and how to reach enforcement without breaking your own mail.
  • DMARC TestTree-walk discovery, inheritance, test mode and the policy receivers really apply.
  • SpoofabilityCan somebody send as you right now? One verdict, no hedging.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.