What Is DMARC? Records, Policies and How to Get to p=reject

Anyone can send an email that claims to come from your domain. DMARC is how you tell the world's mail servers what to do with those messages. So what is DMARC exactly? It is a short DNS record that ties together two older checks, SPF and DKIM, and adds two things they lack: a policy for failing mail and reports that show who is sending as you. Since 2024, Google and Yahoo require it for anyone sending bulk email, and without it your domain is easy to use for phishing.

What Is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is defined in RFC 7489. In plain words, what is DMARC doing? When a mail server receives a message that says it is from you@example.com, it looks up the DMARC record for example.com and asks three questions:

1. Did the message pass SPF or DKIM?
2. Does the domain that passed align with the domain in the visible From address?
3. If not, what does the domain owner want done: nothing, spam folder or reject?

The receiving server then sends you a daily summary of what it saw. That is the reporting part.

How DMARC Works With SPF and DKIM

This alignment step is the heart of the answer to "what is DMARC". A spammer can pass SPF for their own domain and still put your domain in the From line. DMARC catches that because the domains do not match.

What a DMARC Record Looks Like

A DMARC record is a TXT record published at _dmarc. plus your domain:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1

The Three DMARC Policies

• p=none (monitor): failing mail is delivered as normal. You only get reports. This is where everyone should start, and where too many domains stay forever.
• p=quarantine: failing mail goes to the spam folder.
• p=reject: failing mail is refused. This is the only policy that actually stops someone spoofing your domain.

A p=none policy satisfies the Google and Yahoo bulk sender rules, but it does not protect you. It is a step on the way, not the goal.

How to Move From p=none to p=reject Safely

1. Publish p=none with a rua address. Use a mailbox or a DMARC report service. The raw reports are XML and hard to read by hand.
2. List every service that sends as your domain. Your mailbox provider, newsletter tool, CRM, help desk, billing system, website contact forms and anything else. The reports will show the ones you forgot.
3. Fix SPF and DKIM for each one. Add each service to your SPF record and turn on DKIM signing with your own domain in each tool. Most providers have a "custom domain" or "authenticate domain" setting that gives you the DNS records to add.
4. Move to p=quarantine, optionally with pct=25, then raise the percentage while you watch the reports.
5. Move to p=reject once legitimate mail passes consistently, usually after a few weeks of clean reports.
6. Protect domains that never send email with v=DMARC1; p=reject; and an SPF record of v=spf1 -all. Parked domains are a favorite for spoofing because nobody watches them.

How to Check Your DMARC Record

You can look up the record yourself with dig TXT _dmarc.example.com or nslookup -type=TXT _dmarc.example.com. A security scan also checks it for you, alongside the rest of your domain's email setup. It reports:

• No DMARC record found.
• A DMARC policy of p=none, which monitors but does not block spoofed mail.
• No SPF record, and no DKIM key on common selectors such as google, selector1 and default.
• No MTA-STS policy, so mail servers are not told to require encrypted delivery.

The scan checks the apex domain even when you enter a www address, because email records live on the main domain. It is a quick way to see the gaps, though it does not read your DMARC reports or tell you which services are sending mail. For that you still need the rua reports.

Common DMARC Mistakes

• More than one DMARC record. Receivers treat two records as no record at all.
• Staying on p=none for years. Reports alone stop nothing.
• Forgetting third-party senders. Jumping to p=reject before every service passes DKIM or SPF will block your own invoices and newsletters.
• Sending reports to an address nobody reads. Then you miss the senders that would fail when you tighten the policy.
• Typos in the record. A missing semicolon or v=DMARC1 not at the start makes the record invalid.

Summary

What is DMARC, in one line? It is the DNS record that tells mail servers to reject email that pretends to be from your domain, and that reports back on who is sending as you. Start at p=none with reports, fix SPF and DKIM for every sender, then move to p=reject. For more on what a scan report shows and how to prioritize it, see how to read a security scan report.