DMARC
DMARC is a policy layer on top of SPF and DKIM that tells receivers what to do with mail that fails authentication — monitor, quarantine or reject — and sends you reports on who is sending in your domain's name.
How DMARC works
DMARC is a TXT record that does two jobs. First, it sets a policy — none, quarantine or reject — telling receivers how to treat messages that fail authentication and alignment. Second, it requests aggregate reports, so you get a feed of every source sending mail as your domain, legitimate or not.
A message passes DMARC when either SPF or DKIM passes AND is aligned — meaning the authenticated domain matches the visible From domain. That alignment requirement is what actually stops spoofing.
The three DMARC policies
- p=none — monitor only; collect reports without affecting delivery. The starting point.
- p=quarantine — send failing mail to spam. Use once your legitimate sources are all authenticated.
- p=reject — bounce failing mail outright. The end goal; required by Gmail/Yahoo for high-volume senders.
Rolling out DMARC safely
- 1
Publish p=none
Start in monitor mode with a reporting address so you see every sending source without risking legitimate mail.
- 2
Authenticate every source
Work through the reports and make sure each legitimate service passes SPF or DKIM with alignment.
- 3
Move to p=quarantine
Once clean, raise the policy so unauthenticated mail lands in spam, and keep watching reports.
- 4
Enforce with p=reject
Finally, reject failing mail. Your domain can no longer be spoofed into inboxes.
Frequently asked questions
Do I need SPF and DKIM before DMARC?
Yes. DMARC evaluates the results of SPF and DKIM, so both should be in place and aligned before you enforce a policy stricter than p=none.
What is DMARC alignment?
Alignment means the domain authenticated by SPF or DKIM matches the domain in the visible From address. Without alignment, a technically valid signature from another domain wouldn't count.
Is p=reject risky?
Only if you move too fast. Start at p=none, fix every source using the reports, then step up. Done in order, reject is safe and strongly recommended.
Start sending in minutes
Create a free account, connect your domain and reach your audience across every channel — no credit card needed.
Free plan forever · No credit card required · Set up in minutes