DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC is a DNS TXT record at _dmarc.yourdomain.com that does two things: tells
receivers what to do with mail that fails both SPF and DKIM alignment, and tells them where to
send aggregate reports about what they're seeing.
The policy levels
| Policy | What receivers do |
|---|---|
p=none | Monitor only. Nothing is blocked; you just receive reports. This is the safe starting point. |
p=quarantine | Failing mail is typically routed to spam/junk. |
p=reject | Failing mail is typically rejected outright. |
Why enforcement should be gradual
Moving straight to p=reject before you know every legitimate service that sends on
your behalf — your website's contact form, a CRM, an invoicing platform, a marketing tool — can
silently block real mail. The standard path is: publish p=none first, read the
aggregate reports it generates to find every legitimate sender and confirm SPF/DKIM are correctly
aligned for each, then move to quarantine and eventually reject once
you're confident nothing legitimate will be caught.
See DMARC reports for what that aggregate data actually looks like.
Checking your DMARC record
Run dig txt _dmarc.yourdomain.com (or
nslookup -type=txt _dmarc.yourdomain.com on Windows) and look for a line starting
v=DMARC1 — or just run a free check here,
which also tells you whether the policy is actually enforcing, not just present.
Setting one up
Generate a starting DMARC record, or follow a provider guide: Microsoft 365 · Google Workspace. Publish SPF (and ideally DKIM) first — DMARC on its own has nothing to align against.