The problem DMARC solves
The visible From address on an email is trivial to forge — nothing in the base email protocol checks it. That is why phishing that appears to come from your domain lands in inboxes.
SPF and DKIM each authenticate part of a message, but on their own neither protects the address your recipients actually see. A spoofer can pass SPF for their own domain while forging your From. DMARC closes that gap.
How DMARC works
DMARC is a DNS TXT record published at _dmarc.yourdomain.com. When a receiver gets a message, it checks SPF and DKIM, then requires that a passing result aligns with the domain in the From address.
If neither SPF nor DKIM passes in alignment with your domain, the message fails DMARC and the receiver applies your published policy. DMARC also asks receivers to send you reports about who is sending mail as you.
The three policies
The p= tag sets the policy. p=none means monitor only — take no action, just report. p=quarantine tells receivers to treat failing mail with suspicion, usually the spam folder. p=reject tells them to block it outright.
Alignment can be relaxed (the default) or strict, controlled by the adkim and aspf tags. Relaxed alignment allows subdomains to match; strict requires an exact domain match.
Publishing your first record
Start in monitoring mode so you can see your mail streams before enforcing anything. Publish this TXT record at the name _dmarc:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comThe rua address receives the daily aggregate reports. Leave it in monitoring for a few weeks, confirm your legitimate senders pass, then tighten the policy.
Reading the reports
Aggregate (rua) reports are XML summaries sent by receiving providers. They list the sending IPs using your domain and whether they passed SPF and DKIM — the inventory you need before moving to enforcement.
Once your real senders all pass, raise the policy to quarantine and finally reject. Our guide on fixing p=none walks through that rollout.