What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together into a policy: it defines what a receiver should do with a message that passes neither SPF nor DKIM, and where to send reports about it. The record lives as a TXT record at _dmarc.your-domain.com.
Without DMARC anyone can send a message with your domain as the visible sender. SPF and DKIM alone do not prevent that, because they verify the technical sender, not the address the recipient sees. DMARC closes exactly that gap.
The important tags
A DMARC record consists of tag-value pairs separated by semicolons:
- v=DMARC1: version, must be the first tag.
- p=none | quarantine | reject: the policy. none means monitor only, quarantine sends failing mail to spam, reject refuses it.
- sp=: policy for subdomains if it should differ from p.
- pct=: percentage of messages the policy applies to. Useful for a gradual rollout, should end up at 100.
- rua=mailto:...: address for aggregate reports. Without rua you get no feedback about who is sending on behalf of the domain.
- ruf=mailto:...: address for forensic reports. No longer supported by many receivers.
- adkim= and aspf=: alignment mode for DKIM and SPF, r (relaxed) or s (strict).
From p=none to p=reject
The safe path has three stages. First p=none with an rua address, collecting reports for four to eight weeks to find every legitimate sender: newsletter tool, CRM, invoicing system, printers, website forms. Then p=quarantine, ideally starting with pct=25, while continuing to watch the reports. Finally p=reject with pct=100.
The most common mistake is staying at p=none. The policy then offers no protection even though a DMARC record technically exists. The checker flags this as a warning.
v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=sCommon mistakes
What the checker detects:
- No record at _dmarc: the domain is unprotected.
- Multiple records: receivers then ignore all of them.
- p missing or with an invalid value.
- rua address without mailto: or with a typo.
- pct below 100 in permanent operation.
- Subdomain policy weaker than the main policy: attackers move to subdomains.
Monitor DMARC continuously
A policy accidentally weakened from p=reject to p=none goes unnoticed until the first forged invoices are sent in the client's name. DomainWarn detects exactly this change within minutes and reports it as critical.
Frequently asked questions
- Do I need DMARC if I have SPF and DKIM?
- Yes. SPF and DKIM verify technical senders; DMARC additionally checks that they align with the visible sender address and defines what happens on failure.
- What does p=none mean?
- Monitor only. Receivers treat failures no differently than usual but send reports to the rua address. Sensible as a starting point, not as a permanent state.
- Where should the reports go?
- To a mailbox someone actually reads, or to a reporting service. Aggregate reports are XML files and tedious to read without tooling.
- How long does the move to p=reject take?
- Typically six to twelve weeks: collect reports, fix senders, quarantine, then reject.