DMARC

What it is

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that claims to come from your domain but fails authentication, and where to send reports about it.

A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the domain in the visible From header. Without DMARC, attackers can spoof your exact From address even if you publish SPF and DKIM.

How it works

• The record is a TXT record at _dmarc.<domain> starting with v=DMARC1.
• p= sets the policy: none (monitor), quarantine (spam folder) or reject (block).
• sp= sets the policy for subdomains; pct= applies the policy to a percentage of failing mail.
• rua= receives daily aggregate (XML) reports; ruf= receives forensic failure samples (rarely sent nowadays).
• adkim= and aspf= choose relaxed (r, default) or strict (s) alignment.
• Reports sent to another domain require that domain to publish an authorization record at <your-domain>._report._dmarc.<their-domain>.

Examples

v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]

Common mistakes

• Staying at p=none forever

  p=none gives visibility but no protection. Move to quarantine and then reject once reports are clean.

• No rua address

  Without reports you cannot see who sends as your domain, so you cannot safely enforce.

• Third-party report addresses without authorization

  The receiving domain must publish the _report._dmarc record or reports are dropped.

• Syntax errors

  v=DMARC1 must come first, tags are separated by semicolons and mailto: URIs are required.

• Forgetting non-sending domains

  Parked domains should publish p=reject (plus SPF -all) so they cannot be abused.

Specifications

• RFC 7489