DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is an email authentication protocol designed to protect domains from unauthorized use, such as email spoofing and phishing attacks. It builds on two existing technologies—SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail)—to verify the authenticity of emails and provides domain owners with a way to specify how unauthenticated emails should be handled. In short, DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email security protocol that builds on SPF and DKIM to protect your domain from email spoofing, phishing, and unauthorized use.
Authenticates: It checks if an email passes SPF or DKIM (or both).
Aligns: It verifies that the email’s "From" address aligns with the domain used in SPF/DKIM.
Instructions: It tells receiving servers what to do if the email fails authentication (allow, quarantine, or reject).
Reports: It sends reports to you about who’s sending emails using your domain.
_dmarc.example.com IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; sp=none; adkim=s; aspf=s"
Breakdown:
v=DMARC1: Version.
p=reject: Policy for failed emails (none, quarantine, or reject).
rua=mailto:...: Address to receive aggregate reports.
sp=none: Subdomain policy.
adkim=s: DKIM alignment (strict).
aspf=s: SPF alignment (strict).
DMARC integrates with:
SPF: Allows domain owners to define which mail servers are authorized to send emails on their behalf.
DKIM: Attaches a digital signature to emails, enabling recipients to confirm the email’s content hasn’t been altered.
Using these, DMARC enables domain owners to publish a policy in their DNS records. This policy instructs receiving mail servers on what to do if an email fails SPF or DKIM checks. The policy options are:
None: Monitor the email without taking action (used for reporting only).
Quarantine: Treat the email as suspicious (e.g., send it to the spam folder).
Reject: Block the email entirely.
Email Security: Prevents phishing and spoofing by ensuring only authenticated emails are trusted.
Policy Enforcement: Gives domain owners control over how unauthenticated emails are handled.
Reporting: Provides feedback to domain owners about email authentication results, helping them monitor and improve their email setup.
By leveraging SPF and DKIM, DMARC enhances email security, protects a domain’s reputation, and ensures emails reach their intended recipients safely. It’s a vital tool for organizations looking to combat email-based threats and maintain trust with their audience.
Protects your brand from spoofed emails.
Improves deliverability by proving you're a legitimate sender.
Gives visibility into who's using your domain to send email.
A DMARC policy is the part of your DMARC DNS record that tells email receivers what to do with messages that fail SPF and/or DKIM checks.
You set the policy using the p= tag in your DMARC record:
p=none
Do nothing — just monitor.
Good for testing and collecting reports.
Emails that fail still get delivered.
p=quarantine
Treat failing emails as suspicious.
Usually sent to the recipient’s spam/junk folder.
p=reject
Reject emails that fail DMARC.
The receiving server won’t deliver them at all.
p=quarantine:_dmarc.example.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
none = monitor only
quarantine = send to spam
reject = block entirely
Start with none, monitor the reports, then move to quarantine or reject as you gain confidence.
Want help writing a safe starting DMARC policy?
Schedule a call with us, and we will help you with that.