DMARC
DMARC checks whether SPF or DKIM aligns with the visible From domain and lets its owner request how receivers handle failures.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy published in DNS that tells receiving servers what you want done with mail that fails both aligned SPF and aligned DKIM, and sends you reports about who is sending as your domain.
How it works
A receiving server checks whether SPF or DKIM passed and whether the passing domain aligns with the visible From domain. A message passes DMARC when either aligned check passes. If neither does, your policy states what you request: p=none only reports, p=quarantine asks receivers to treat the message as suspicious, usually by spam foldering, and p=reject asks them to refuse it. Receivers may apply their own local policy instead (RFC 9989, section 5.4). Aggregate reports sent to the rua address show which sources pass and fail.
Because it protects the domain people see, DMARC is the layer that makes spoofing your From address harder. It also exposes forgotten senders: a vendor mailing as your domain with neither aligned SPF nor aligned DKIM shows up in the reports as a failure.
Common mistakes
Moving to
p=rejectbefore alignment is fixed, which blocks legitimate mail. Start atp=noneand review reports first.Missing alignment. The visible From domain must match the SPF or DKIM domain, otherwise DMARC fails even when SPF and DKIM pass on their own.
No reporting address. Without
ruaand a mailbox to receive it, you cannot see who is sending as your domain or where failures occur.More than one record at
_dmarc.example.com. Duplicates cause providers to ignore DMARC.Wrong host or type. DMARC is a TXT record at
_dmarc.example.com, not at the root and not a CNAME.Forgetting subdomains. Check which policy applies to each sending subdomain. The optional
sptag can specify a different subdomain policy, and a subdomain can publish its own record.Switching to strict alignment before every sender can pass for the exact From domain. Relaxed alignment, the default, accepts a match at the organizational domain and is a legitimate long-term setting.
See Google’s sender guidelines for bulk-sender requirements and the Loops docs on reducing bounce rate.