What DMARC does
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.yourdomain.com. It builds on SPF and DKIM: a message passes DMARC when it aligns with a passing SPF or DKIM check.
The policy tag (p=) tells the receiver what to do with mail that fails — none (monitor only), quarantine (send to spam), or reject (block outright).
How to read your result
Nattvakt reports a pass when a single valid DMARC record exists with an enforcing policy (quarantine or reject). A p=none policy shows as a warning: it is a monitoring stage, not protection.
No record at all is a failure — your domain can be spoofed freely, and phishing sent "from" you will land in inboxes.
Fixing common DMARC problems
Start at v=DMARC1; p=none; rua=mailto:you@yourdomain to collect aggregate reports. Confirm your legitimate mail passes, then tighten the policy to quarantine and finally reject.
Make sure SPF and DKIM are aligned first, or enforcement will bounce your own mail. Keep exactly one DMARC record.
Frequently asked questions
What is a DMARC record?
A DNS TXT record at _dmarc.<domain> that begins with v=DMARC1 and tells receiving servers how to handle mail that fails SPF and DKIM authentication.
Is p=none enough?
No. p=none only monitors; it does not stop spoofed mail. Use it briefly to gather reports, then move to p=quarantine or p=reject.
Do I need SPF and DKIM for DMARC to work?
Yes. DMARC passes when a message aligns with a passing SPF or DKIM result, so at least one must be correctly configured and aligned with your domain.
Where do DMARC reports go?
To the addresses in the rua (aggregate) and ruf (forensic) tags of your record.