Skip to content

Glossary · Domain-based Message Authentication, Reporting, and Conformance

What is DMARC?

Quick answer

DMARC is a DNS policy that tells receiving servers what to do with mail claiming to come from your domain when it fails authentication: deliver it anyway, send it to spam or reject it. It also asks receivers to send you reports on every source using your domain. Gmail, Yahoo and Outlook.com now require a DMARC record from bulk senders.

Definition

DMARC (Domain-based Message Authentication, Reporting, and Conformance): A policy published as a TXT record at _dmarc.<domain> that tells receivers how to handle mail failing authentication: p=none, quarantine or reject. A message passes when SPF or DKIM passes for a domain aligned with the From address. Now defined in RFC 9989, which replaced RFC 7489 in 2026.

How DMARC works

When a message arrives, the receiver takes the domain from the visible From header and looks up a TXT record at _dmarc on that domain. It then checks whether SPF or DKIM passed for a domain that aligns with From.

If either one did, DMARC passes. If neither did, the receiver applies the p= policy: none (deliver and report), quarantine (usually the spam folder) or reject (refuse during the SMTP session). The sp= tag sets a separate policy for subdomains.

How to roll out DMARC from p=none to p=reject

Start with p=none and a rua= address so you receive aggregate reports without affecting delivery. The reports list every IP sending as your domain and whether it passed SPF and DKIM with alignment.

Fix each legitimate source you find, such as a billing system or a CRM that sends as you. Once your own mail passes consistently, move to quarantine, watch the reports again, then move to reject.

Who requires DMARC

Google requires bulk senders, those sending more than 5,000 messages a day to personal Gmail accounts, to publish a DMARC record with at least p=none and to pass DMARC alignment. Yahoo has the same expectation for bulk senders.

Microsoft requires SPF, DKIM and DMARC from senders of more than 5,000 messages a day to Outlook.com, Hotmail and Live.com addresses. A missing record now causes rejections, not just lower placement.

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"
A DMARC record at quarantine, with aggregate reports and relaxed alignment for both SPF and DKIM.

How RocketVerifier handles it

Our free DMARC checker reads and grades your policy, reporting and alignment settings, and the DMARC record generator builds a valid record with the policy you choose. The email deliverability checker scores SPF, DKIM and DMARC together and gives clear fixes. Monitors recheck SPF, DKIM, DMARC and blocklist status on a schedule and alert you when something changes.

Go further

Sources

  1. RFC 9989: DMARC (Proposed Standard, May 2026, obsoletes RFC 7489)
  2. Google: Email sender guidelines
  3. Microsoft: Outlook's requirements for high-volume senders

FAQ

DMARC: common questions

Does DMARC stop all spoofing?

It stops exact-domain spoofing, where someone puts your domain in the From header. It does not stop lookalike domains such as examp1e.com or a forged display name over an unrelated address.

What is the difference between rua and ruf reports?

rua reports are aggregate XML summaries, usually sent once a day, listing sending IPs and their pass or fail counts. ruf reports are per-message failure samples, and few large providers send them because they can contain message content.

Will p=reject block my own email?

Only from sources that are not aligned. That is why you read reports at p=none first: any legitimate tool sending as your domain without aligned SPF or DKIM shows up there before it can be rejected.

Turn definitions into a cleaner list

Verify your first emails in minutes. Credits never expire, and unknown results are always free.

Start free Browse the glossary

100 free credits · No card required · Credits never expire