DMARC (Domain-based Message Authentication, Reporting and Conformance) is the layer that sits on top of SPF and DKIM. It does two jobs: it tells receiving mail servers what to do with messages that claim to be from your domain but fail authentication, and it sends you reports about who is sending mail as you.
Without DMARC, SPF and DKIM are advisory. A receiver can see that a message failed and still deliver it. With DMARC you decide what should happen.
The problem DMARC solves
SPF checks the hidden envelope sender. DKIM checks the domain that signed the message. Neither one is required to match the address the reader sees in the From line. So a criminal can send from their own server, pass SPF and DKIM for their domain, and still show [email protected] as the sender.
DMARC closes the gap with alignment. A message passes DMARC only if at least one of these is true:
- SPF passes and the SPF domain matches the From domain, or
- DKIM passes and the signing domain (
d=) matches the From domain.
Only one of the two needs to align. That is why it is worth having both: if forwarding breaks SPF, a good DKIM signature still carries the message.
What a DMARC record looks like
DMARC is a TXT record published at _dmarc.yourdomain.com:
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r"| Tag | Meaning |
|---|---|
v=DMARC1 | Required version tag, must come first |
p= | The policy for your domain: none, quarantine or reject |
sp= | Optional different policy for subdomains |
rua= | Where to send daily aggregate reports |
adkim= / aspf= | Alignment mode: r relaxed (default) or s strict |
pct= | Percentage of failing mail the policy applies to |
The three policies
p=noneis monitoring only. Nothing changes for delivery, but you start receiving reports. This is where everyone should begin.p=quarantineasks receivers to treat failing mail with suspicion, usually by placing it in spam.p=rejectasks receivers to refuse failing mail outright. This gives the strongest protection against spoofing of your domain.
Do not jump to reject on day one. Some legitimate system you forgot about, such as an invoicing tool or a CRM, will be sending as your domain without proper authentication, and a strict policy would block it. Our step-by-step plan is in how to roll out DMARC safely.
Relaxed versus strict alignment
With relaxed alignment (the default), mail.yourdomain.com aligns with yourdomain.com: the organisational domain just has to match. With strict alignment the names must be identical. Relaxed is right for almost everyone, because it lets you send from subdomains without extra work.
Why you should care in 2026
Major mailbox providers expect authenticated mail. Gmail and Yahoo introduced requirements in 2024 that bulk senders must publish a DMARC record, and other providers have announced similar rules. Even if you send small volumes, having DMARC in place protects your brand from spoofing and helps legitimate mail get treated fairly. We explain the details in Gmail and Yahoo sender requirements.
Steps to publish your first DMARC record
- Make sure SPF and DKIM are working for every service that sends as your domain.
- Create a mailbox or alias to receive reports, for example
[email protected]. - Publish a TXT record at
_dmarcwithp=noneand yourruaaddress. - Wait a week or two and read the reports to find senders that fail.
- Fix those, then move to
quarantineand laterreject.
Remember that a domain must have only one DMARC record. If a record exists already, edit it instead of adding a second one.
How Mailions helps
The DNS checklist for each domain in Mailions includes a suggested DMARC record (it starts at p=quarantine) along with MX, SPF and the domain's DKIM key. The check reads live public DNS and accepts any valid single DMARC record, so you can publish p=none first if you have not yet mapped your senders. You can create a mailbox or alias on the domain to collect aggregate reports. Authentication supports deliverability but does not guarantee inbox placement, which also depends on reputation and content.