DMARC

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy that builds on SPF and DKIM to stop domain spoofing. It uses “alignment” to check that the authenticated domain matches the visible From address, tells receiving mail servers what to do when a message fails (none, quarantine, or reject), and sends you reports showing who is sending mail as your domain.

DMARC is the layer that turns SPF and DKIM from isolated checks into an enforceable, monitored policy. Without it, a receiver can verify that a message passed SPF but still has no instruction about what to do with mail that fails — and no way to tell you it happened.

How DMARC works

DMARC does not replace SPF and DKIM; it sits on top of them and adds one crucial test: alignment. A message passes DMARC if SPF or DKIM authenticates the message and the authenticated domain aligns with the domain in the visible From: header that recipients actually see.

That “or” matters. A message only needs one of the two to pass and align:

• SPF alignment — the message passes SPF, and the domain in the Return-Path (envelope sender) matches the From domain.
• DKIM alignment — the message carries a valid DKIM signature, and the signing domain (d=) matches the From domain.

If neither authenticates and aligns, the message fails DMARC and the receiver applies your published policy. This alignment step is what actually blocks spoofing: attackers can send from infrastructure that passes SPF or DKIM for their own domain, but they can’t align it with your From address.

The parts of DMARC

DMARC breaks down into a few connected pieces, each covered in its own guide:

• What DMARC is — the concept, why it exists, and where it fits alongside SPF and DKIM.
• The DMARC record — the TXT record you publish at _dmarc.yourdomain.com and the tags inside it.
• The DMARC policy — the p= value that sets enforcement: none, quarantine, or reject.
• How to set up DMARC — a step-by-step rollout from monitoring to full enforcement.

A typical enforcement record looks like this:

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s

Here p=reject blocks failing mail, rua sets the address for aggregate reports, and adkim=s / aspf=s require strict alignment.

Why SPF matters for DMARC

This is where most DMARC deployments quietly break. DMARC depends on SPF (or DKIM) both passing and aligning — so if your SPF record is broken, DMARC gets weaker without any obvious warning.

The most common failure is the SPF 10-lookup limit. SPF caps the number of DNS lookups a record can trigger at ten. When you chain include: mechanisms for your email provider, marketing platform, help desk, and CRM, you can blow past that ceiling. When you do, SPF returns PermError, and many receivers treat that as an SPF failure. Your legitimate mail suddenly stops passing SPF alignment, and DMARC now leans entirely on DKIM — leaving no margin for error.

To keep DMARC solid, keep SPF healthy:

• Run your domain through the SPF Checker to confirm it resolves cleanly and stays under ten lookups.
• Review your SPF record syntax so every mechanism and qualifier is correct.
• Let AutoSPF flatten and maintain your SPF record automatically, so it stays valid, under the lookup limit, and always aligned — which keeps DMARC alignment holding no matter how many senders you add.

A valid SPF record is not optional for DMARC. It is one of the two foundations DMARC checks alignment against.

DMARC in the bigger picture

DMARC is the enforcement and reporting layer of a three-part system. To see how the pieces fit — SPF authorizing senders, DKIM signing messages, and DMARC deciding what happens on failure — start with the email authentication hub, then compare the roles directly with SPF vs DMARC and DKIM vs DMARC. Understanding those relationships is the fastest way to deploy DMARC without accidentally blocking your own mail.

Check your DMARC

Not sure whether your DMARC record is published or set to the right policy? Run your domain through the free DMARC checker to see your current record, policy, and alignment settings in seconds.

Frequently Asked Questions

What is DMARC?

DMARC is a DNS-based email authentication policy that builds on SPF and DKIM. Published as a TXT record, it uses alignment to confirm the authenticated domain matches the visible From address, tells receivers whether to allow, quarantine, or reject failing mail, and sends aggregate reports so you can see who sends mail as your domain.

How does DMARC work with SPF and DKIM?

DMARC checks the results of SPF and DKIM, then adds an alignment test. A message passes DMARC if either SPF or DKIM authenticates it and that authenticated domain aligns with the From domain recipients see. Only one of the two needs to pass and align, but at least one must — otherwise your published policy applies.

Is DMARC required?

DMARC is not universally mandated, but major mailbox providers like Google and Yahoo now require it for bulk senders, and many security frameworks expect it. Even where it is optional, publishing DMARC is strongly recommended: it is the only mechanism that stops spoofing of your domain and reports unauthorized senders back to you.

What does p=reject mean?

p=reject is the strictest DMARC policy. It instructs receiving servers to refuse any message that fails DMARC authentication and alignment, so spoofed mail is blocked outright rather than delivered to spam. Before moving to p=reject, confirm your legitimate senders all pass SPF or DKIM alignment, or you risk blocking your own valid mail.