DMARC record

The rule that tells servers what to do with mail that fails SPF and DKIM checks

📖 Detailed description

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the glue that ties SPF and DKIM together into one coherent protection system. SPF and DKIM verify whether a message is authentic - but it is the DMARC record that tells the recipient server what to do with mail that fails those checks: let it through, mark it as spam, or reject it entirely.

Without DMARC your protection is only half-built. It is a bit like installing a home alarm but never deciding what should happen when it goes off. DMARC closes that gap: you define a policy (p=), and on top of that you receive reports about who is sending mail that impersonates your domain and from where.

How do you configure DMARC? You add a TXT record for the _dmarc subdomain that starts with v=DMARC1 and contains a policy. You start with p=none (monitoring mode - only collecting reports, no blocking), analyze the reports, and once you are confident that legitimate mail passes authentication, you tighten it to p=quarantine and ultimately p=reject. You provide the reporting address in the rua= tag.

You can check whether your domain publishes a DMARC record and what policy it uses with our free DNS Lookup tool at /dns.

Most common problems

No DMARC record

SPF and DKIM operate in a vacuum - nobody knows what to do with fakes, and you get no abuse reports

Stuck on p=none

Monitoring mode blocks nothing - impersonation is still possible

Jumping to p=reject too soon

Without analyzing reports, legitimate mail (such as a newsletter) can start disappearing

No rua address

You give up reports - the only window into who is impersonating your domain

How to fix it?

Start with p=none and set a rua= address to collect reports for a few weeks

Analyze the reports and make sure all legitimate mail passes SPF or DKIM

Tighten the policy gradually: none → quarantine → reject

Set alignment so the SPF/DKIM domain matches the sender domain

Place the record exactly at _dmarc.yourdomain.com as a TXT type

Examples

Good example

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; fo=1

Bad example

no _dmarc record (or v=DMARC1; p=none permanently, with no reporting address)

🔗 Related indicators

📧

SPF record (Sender Policy Framework)

A list of servers allowed to send email on behalf of your domain - the foundation of anti-spoofing protection

📧

DKIM signature (DomainKeys Identified Mail)

A digital seal attached to every email - proof that the content was not altered in transit

🔐

DNSSEC (DNS security)

Digital signatures that guarantee a DNS answer was not swapped by an attacker

Check this indicator for your website

Get a detailed analysis and personalized tips on how to improve this element on your website.

Start free analysis