What Is DMARC (Domain-based Message Authentication)?

How DMARC works

DMARC is defined in RFC 7489. A domain publishes a DNS TXT record at _dmarc.yourdomain.com specifying a policy, like v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com. When mail arrives claiming to be from that domain, the receiving server checks whether SPF and/or DKIM passed and whether the authenticated domain is aligned with the visible From: header domain. If neither mechanism aligns, DMARC’s policy (none, quarantine, or reject) tells the receiver what to do with the message.

Why “alignment” is the key concept

A message can technically pass SPF (the envelope sender’s domain matches an authorized IP) while still failing DMARC, if that authenticated domain doesn’t match the domain shown in the From: header the recipient sees. This is intentional — it’s what stops an attacker from sending mail that passes SPF for their own domain while spoofing your domain’s From: address to trick recipients.

Reading a DMARC aggregate report

Domains that specify a rua address receive daily aggregate XML reports from major mailbox providers, showing how much mail claiming to be from the domain passed or failed SPF/DKIM alignment, broken down by sending IP. This is the primary way to discover unauthorized or misconfigured senders (a forgotten marketing tool, a phishing campaign spoofing the domain) before tightening policy from none to quarantine or reject.

Why 2024-2026 mandates made DMARC non-optional

Gmail and Yahoo’s bulk-sender requirements, phased in from February 2024, require a DMARC record (minimum p=none) for any domain sending 5,000+ messages per day to their users — without it, bulk mail can be rejected outright regardless of content quality or list health.

How common is DMARC enforcement, really?

We ran our own DMARC/SPF adoption study against 214 well-known company domains: 98.6% publish a DMARC record, but only 92.4% of those have moved past monitor-only to actually enforce it with quarantine or reject. Publishing the record is the easy part — enforcing it is where most of the real protection comes from.