What is DMARC? Policies, alignment and reports

What DMARC adds

SPF and DKIM each prove something about a message, but neither one checks the From address you actually see. DMARC (Domain-based Message Authentication, Reporting and Conformance) fills that gap. It was published as RFC 7489 in 2015.

DMARC does three things. It requires that SPF or DKIM pass for a domain that matches the From address. It lets the domain owner say what receivers should do with mail that fails. And it asks receivers to send reports back, so the owner can see who is sending mail in their name.

DMARC does not add a new check of its own. It reuses the results of SPF and DKIM, so a domain needs at least one of them set up correctly before DMARC can pass. In practice, most domains set up both.

Alignment

The key idea is alignment. For a message from billing@example.com to pass DMARC, at least one of these must be true: SPF passes and the envelope sender (Return-Path) is at example.com, or DKIM passes and the signature's d= domain is example.com.

By default, alignment is relaxed, so subdomains count: a DKIM signature from mail.example.com aligns with a From address at example.com. A domain can require an exact match with adkim=s and aspf=s (strict).

Reading a DMARC record

The policy is a TXT record at _dmarc followed by the domain:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"

Policies and reports

The p= tag is the policy. p=none means take no action, just report; it is where most domains start. p=quarantine asks receivers to treat failing mail as suspicious, which usually means the spam folder. p=reject asks them to refuse it during delivery. Receivers make the final call, but large providers generally follow the policy. A separate sp= tag can set a different policy for subdomains.

The rua= address receives aggregate reports, usually once a day. They are XML files listing which servers sent mail using the domain, how many messages, and whether SPF and DKIM passed and aligned. They contain no message content. Owners use them to find services they forgot to set up before moving to a stricter policy.

Since 2024, Google and Yahoo require bulk senders to publish at least a p=none DMARC record, which pushed many domains to set one up for the first time.