DMARC

What DMARC is

Domain-based Message Authentication, Reporting, and Conformance is the policy layer on top of SPF and DKIM. Those two mechanisms produce pass or fail results, but each authenticates a different identity: SPF checks the envelope sender, DKIM checks the signing domain, and neither is required to match the From: address a person sees. DMARC closes that gap. It passes only if at least one of SPF or DKIM passes and the domain it authenticated aligns with the From: domain. It then tells receivers what to do with mail that fails.

The policy is a TXT record at _dmarc.example.com:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=r

Reading the tags

• p= is the policy for failing mail: none (deliver, just report), quarantine (send to spam), or reject (refuse).
• rua= is where aggregate reports go. Receivers send a daily XML summary of which sources sent mail for your domain and how it authenticated.
• ruf= requests forensic reports for individual failures; many receivers no longer send them.
• adkim= and aspf= set alignment to relaxed (r, subdomains allowed) or strict (s, exact match).
• pct= applies the policy to a percentage of failing mail, useful while rolling out.
• sp= sets a separate policy for subdomains.

Why it matters

A domain without DMARC, or with p=none, can be impersonated in the visible From: field, and that is what phishing relies on. Major mailbox providers now require a DMARC record from anyone sending mail in volume, and they rank mail from domains with an enforcing policy more favorably. The reports are valuable on their own: they reveal every service sending as your domain, including forgotten ones and forgers, which is the information you need before moving from none to reject.

How to check

Use the DNS lookup tool with the type set to TXT on _dmarc.yourdomain.com. There must be exactly one record starting with v=DMARC1. To see DMARC in action, paste a received message's headers into the email header analyzer: the Authentication-Results line shows dmarc=pass or dmarc=fail with the policy the receiver applied.

A sensible rollout

Start with p=none and a rua= address, read the reports for a few weeks, fix every legitimate source that fails, move to p=quarantine with pct= increasing over time, and finish at p=reject. Skipping the monitoring step is how companies lose their own invoices to the spam folder.