# What is DMARC, and how does it work?

URL: https://iblockspam.com/blog/what-is-dmarc
Last updated: 2026-10-09
Published: 2026-10-09
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> What DMARC is, how it uses SPF and DKIM alignment, what p=none, quarantine and reject do, what the reports show, and how to set it up in five safe steps.

## Short answer

DMARC is a DNS TXT record at _dmarc.yourdomain that tells receivers what to do with mail that uses your domain in the From address but can't prove it. A message passes when SPF or DKIM passes for a domain that aligns with the From domain. Your policy says none, quarantine or reject, and receivers send you reports.

DMARC is the record that finally ties email authentication to the address people actually read. SPF and DKIM can both pass on a forged message, because neither one checks the visible From line. DMARC does, and it lets you tell receivers what to do when that check fails. This is the hub for our DMARC guides: start here, then follow the links for each step.

## What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. Since May 2026 it is defined in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), a Standards Track document that replaced RFC 7489. Reporting moved into two companion documents: [RFC 9990](https://www.rfc-editor.org/rfc/rfc9990.html) for aggregate reports and [RFC 9991](https://www.rfc-editor.org/rfc/rfc9991.html) for failure reports.

The record itself is a single TXT record at `_dmarc.` in front of your domain:

```
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
```

It does three things:

1. **Validates** that mail using your domain in the From header really comes from you.
2. **States a policy** for mail that fails: `none`, `quarantine` or `reject`.
3. **Requests reports** so you can see every source sending as your domain.

DMARC doesn't scan content and doesn't look at the display name. RFC 9989 lists display name attacks and content analysis as out of scope. It also validates only the domain, not the part of the address before the @.

## How does DMARC work with SPF and DKIM?

DMARC doesn't authenticate anything by itself. It reuses the results of two older checks:

- **SPF** ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html)) checks whether the sending server is allowed to use the envelope sender domain (the MAIL FROM, often shown as Return-Path).
- **DKIM** ([RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html)) checks a cryptographic signature added by the sender. The signing domain is the `d=` value in the `DKIM-Signature` header.

The receiver then asks one question: did SPF or DKIM pass **for a domain that aligns with the From domain**? RFC 9989 section 5.3.5 puts it simply: if one or more authenticated identifiers align with the Author Domain, the message passes. If none do, it fails.

Here's the order of events at the receiving server:

1. Read the domain in the `From:` header (RFC 9989 calls it the Author Domain).
2. Look up the DMARC record for it, walking up the DNS tree to the organizational domain if the exact name has none.
3. Take the SPF result for the MAIL FROM domain and the DKIM result for each valid signature.
4. Check whether any passing domain aligns with the From domain.
5. Pass or fail, then apply local policy, informed by your `p=` value, and log the result for reports.

If you want the background on what each of the three checks proves on its own, read [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc).

## What is DMARC alignment?

Alignment is the heart of DMARC. Without it, an attacker could publish SPF and DKIM for their own domain, pass both, and still put your domain in From. RFC 9989 section 4.4.1 says it directly: "a message can bear a valid signature from any domain, even one used by a bad actor."

There are two alignment modes:

- **Relaxed** (the default): the two domains share the same organizational domain. `mail.example.com` aligns with `example.com`.
- **Strict**: the two domains are identical.

This table follows the examples in RFC 9989 section 4.4:

| Authenticated domain (SPF or DKIM) | From domain | Alignment |
|---|---|---|
| `foo.example.com` | `news.example.com` | Relaxed: same organizational domain |
| `news.example.com` | `news.example.com` | Strict: identical |
| `foo.example.net` | `news.example.com` | None: different organizational domains |

RFC 9989 notes that "nearly all Domain Owners have found relaxed alignment sufficient." Leave `adkim` and `aspf` at their relaxed defaults unless you have a specific reason.

## What do p=none, p=quarantine and p=reject mean?

The `p` tag is your request to receivers about mail that fails DMARC. Receivers make the final decision. RFC 9989 section 7.4 even says receivers must not reject solely on the basis of `p=reject`, without other knowledge and analysis.

| Policy | What you're asking for | What usually happens | When to use it |
|---|---|---|---|
| `p=none` | No handling preference; just report | Normal delivery, normal filtering | At least a month, while you find all senders |
| `p=quarantine` | Treat failures as suspicious | Junk folder or quarantine | After reports show your senders pass |
| `p=reject` | Refuse failing mail | Rejected during SMTP | Final state, and for domains that never send mail |

Microsoft documents how it handles each one for inbound mail when **Honor DMARC record policy** is on: `p=quarantine` goes to Junk Email, and `p=reject` is rejected during SMTP with a `dmarc=fail action=oreject` result ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)).

Two more tags shape the policy. `sp` sets it for existing subdomains and `np` for subdomains that don't exist. If left out, `np` falls back to `sp`, and `sp` falls back to `p`. Our [DMARC subdomain policy guide](https://iblockspam.com/blog/dmarc-subdomain-policy-sp) explains the inheritance. The `t=y` tag, new in RFC 9989, asks receivers to apply your policy one level down while you test. Every tag is explained in [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples).

## What are DMARC reports?

When your record includes `rua=mailto:...`, receivers that support reporting send you aggregate reports: compressed XML files listing each sending IP, how many messages it sent as your domain, and whether SPF and DKIM passed and aligned. RFC 9989 section 5.3.8 says receivers should send them at least once every 24 hours.

Aggregate reports are how you find the invoicing tool, CRM or website form that sends as your domain without authentication. They're hard to read raw. Our free [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer) turns a report into a table in your browser, and [how to read DMARC reports](https://iblockspam.com/blog/how-to-read-dmarc-reports) explains each field.

The `ruf` tag requests failure reports about individual messages. RFC 9989 notes that privacy-minded receivers either redact them heavily or don't send them at all, and Microsoft 365 doesn't send them. Start with `rua` only.

## How do I set up DMARC?

In outline, following RFC 9989 section 5.1 and [Google's DMARC guide](https://knowledge.workspace.google.com/admin/security/set-up-dmarc):

1. List every service that sends as your domain, and give each one aligned SPF or DKIM. Our [DKIM setup guide](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) and [SPF records by provider](https://iblockspam.com/spf) pages cover the common ones.
2. Publish `p=none` with an `rua` address. The [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record.
3. Read the reports, fix failing senders, then move to `p=quarantine` and `p=reject`.

The full procedure, with the record for each stage and how long to stay there, is in [moving DMARC from p=none to p=reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business). If a scanner says your DMARC policy is not enabled, start with [fixing "DMARC policy not enabled"](https://iblockspam.com/blog/dmarc-policy-not-enabled). A domain that never sends email can skip the rollout and publish `p=reject` straight away, as shown in [protecting parked domains from spoofing](https://iblockspam.com/blog/protect-parked-domains-from-spoofing).

## Do I need DMARC?

If your domain sends email, yes. For bulk senders it's now a hard requirement:

- Google requires SPF, DKIM and DMARC from senders of close to 5,000 or more messages a day to personal Gmail accounts, with the From domain aligned to SPF or DKIM. The policy can be `none` ([Google sender guidelines](https://support.google.com/mail/answer/81126)). [Google Postmaster Tools](https://iblockspam.com/blog/google-postmaster-tools-guide) shows whether Gmail sees you as compliant.
- Yahoo requires bulk senders to "publish a valid DMARC policy with at least p=none" and says DMARC must pass ([Yahoo Sender Hub](https://senders.yahooinc.com/best-practices/)). It strongly urges all other senders to publish one too.

The details are in our [Gmail, Yahoo and Microsoft bulk sender requirements](https://iblockspam.com/blog/gmail-yahoo-microsoft-bulk-sender-requirements) guide.

Plenty of large domains still aren't protected. In our [scan of the Tranco top 1,000 domains](https://iblockspam.com/research/email-security-top-1000) in October 2026, 26.5% had no DMARC record and 38.3% didn't enforce DMARC.

## What DMARC doesn't do

DMARC is strong against one specific attack: mail that puts your exact domain in From. It doesn't stop:

- **Lookalike domains** such as `examp1e.com`, which have their own DNS. See [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).
- **Display name tricks**, where the name says "CEO" but the address is a free mailbox.
- **Spam and phishing sent to you** from domains that authenticate correctly.

It protects your domain in other people's inboxes. Mail arriving at your own domain still needs inbound filtering.

## Our DMARC guides

| If you need to... | Read |
|---|---|
| Write or fix a record, tag by tag | [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) |
| Clear a "DMARC policy not enabled" warning | [DMARC policy not enabled: how to fix it](https://iblockspam.com/blog/dmarc-policy-not-enabled) |
| Move safely to enforcement | [From p=none to p=reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) |
| Understand the XML reports | [How to read DMARC reports](https://iblockspam.com/blog/how-to-read-dmarc-reports) |
| Fix `dmarc=fail` on real mail | [Why DMARC fails](https://iblockspam.com/blog/why-dmarc-fails) |
| Cover subdomains | [DMARC subdomain policy](https://iblockspam.com/blog/dmarc-subdomain-policy-sp) |
| Handle forwarding and mailing lists | [Why forwarding breaks SPF and DMARC](https://iblockspam.com/blog/email-forwarding-breaks-spf-dmarc-arc) |
| Find or fix DKIM | [Find your DKIM selector](https://iblockspam.com/blog/find-dkim-selector) and [DKIM body hash did not verify](https://iblockspam.com/blog/dkim-fail-body-hash-did-not-verify) |

## Next steps

1. Check your domain with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker). It shows whether you have a record, what the policy is, and whether reporting is set up.
2. If you have no record, list your senders and confirm SPF and DKIM with the [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DKIM Checker](https://iblockspam.com/tools/dkim-checker).
3. Publish `p=none` with a reporting address, using the [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator).
4. Review at least a month of reports, fix failing senders, then move to `quarantine` and `reject`.

DMARC protects your domain's name elsewhere. For the mail coming in, an inbound filter such as iBlockSpam screens for spam, phishing and spoofing before it reaches your users; see [how it works](https://iblockspam.com/how-it-works).

Once your record has a reporting address, iBlockSpam's [DMARC monitoring](https://iblockspam.com/features/dmarc-monitoring) can read the daily reports for you and say when your senders are ready for a stricter policy. If you only want to know when your DMARC, SPF or MX records change, the [Free Domain Watch](https://iblockspam.com/free-monitoring) checks them weekly at no cost.

Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### What does DMARC stand for?

Domain-based Message Authentication, Reporting, and Conformance. The name lists its three jobs: it authenticates the domain in the visible From address, it gives you reports on who sends mail as that domain, and it lets you state how receivers should treat mail that doesn't conform.

### Can DMARC block my own legitimate email?

Yes, if you enforce too early. At p=quarantine or p=reject, any service that sends as your domain without aligned SPF or DKIM gets junked or refused. That's why RFC 9989 says to start at p=none and read aggregate reports until every legitimate sender passes before you enforce.

### Does a message need both SPF and DKIM to pass DMARC?

No. One aligned pass is enough. RFC 9989 says a message passes if one or more authenticated identifiers align with the From domain. Aim for both anyway: SPF usually breaks when mail is forwarded, while DKIM signatures generally survive forwarding.

### Is DMARC mandatory for sending to Gmail and Yahoo?

For bulk senders, yes. Google requires DMARC for senders of close to 5,000 or more messages a day to personal Gmail accounts, and Yahoo requires bulk senders to publish a valid policy of at least p=none. Both strongly recommend DMARC for everyone else too.

### What is the difference between DMARC and DKIM?

DKIM signs a message with a key published under some domain, which proves that domain handled it. DMARC adds the missing link: it checks that the DKIM (or SPF) domain matches the domain people see in From, and it publishes your policy and reporting address. DKIM alone doesn't stop From spoofing.

## Sources

- [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html)
- [RFC 9990: DMARC Aggregate Reporting](https://www.rfc-editor.org/rfc/rfc9990.html)
- [RFC 9991: DMARC Failure Reporting](https://www.rfc-editor.org/rfc/rfc9991.html)
- [Microsoft Learn: Set up DMARC to validate email in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [Google Workspace Admin Help: Set up DMARC](https://knowledge.workspace.google.com/admin/security/set-up-dmarc)
- [Gmail Help: Email sender guidelines](https://support.google.com/mail/answer/81126)
- [Yahoo Sender Hub: Sender best practices](https://senders.yahooinc.com/best-practices/)

## Free tools for this guide

- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings.
- [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer): Read DMARC aggregate reports (XML, gzip or zip): see who sends as your domain and what fails — runs in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/what-is-dmarc (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt