What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a DNS TXT record that protects your domain from email spoofing. It builds on SPF and DKIM and does three things:
- Alignment: it requires that the domain checked by SPF or DKIM matches the domain in the visible From address. Without DMARC, a scammer can pass SPF with their own domain while showing yours to the reader.
- Policy: it tells receivers what to do with mail that fails: nothing, send it to spam, or reject it.
- Reporting: it asks receivers to send you reports about all mail using your domain, so you can see who is sending as you.
The record lives at _dmarc.yourdomain.com and looks like this:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comHow to use the DMARC checker
- Enter your domain. The checker looks up
_dmarc.yourdomain; for a subdomain without its own record, it checks the parent domain, as receivers do. - You get a grade from A to F, a list of problems and good points, and every tag explained.
- Below the results you get a recommended record: the safe next step for your domain, ready to copy.
How to read the results
- Grade: A is a valid record with
p=quarantineorp=rejectand reporting enabled.p=noneand missing reports lower the grade; a missing or invalid record gets an F. - Results: each finding in plain English, from the most serious to the positive ones.
- Tags explained: what each part of your record does.
- Recommended record: your current settings moved one step forward (none → quarantine → reject), always with reporting.
DMARC tags explained
| Tag | Meaning | Values |
|---|---|---|
v | Version. Required, must be first. | DMARC1 |
p | Policy for the domain. Required. | none, quarantine, reject |
sp | Policy for subdomains. Defaults to p. | Same as p |
rua | Where to send daily aggregate reports. | mailto: addresses, comma separated |
ruf | Where to send per-message failure reports. Few providers send them. | mailto: addresses |
pct | Percentage of failing mail the policy applies to. Defaults to 100. | 0–100 |
adkim | DKIM alignment mode. | r relaxed (default), s strict |
aspf | SPF alignment mode. | r relaxed (default), s strict |
fo | When to generate failure reports. | 0, 1, d, s |
p=none vs p=quarantine vs p=reject
p=none: monitoring
Receivers take no action; they only send you reports. It is the right first step because you learn
which services send mail as you before enforcing anything. But it does not protect you: spoofed mail is still
delivered. Staying on p=none forever is one of the most common DMARC mistakes.
p=quarantine: spam folder
Mail that fails DMARC goes to the recipient's spam folder. It is a good intermediate step: if you forgot a legitimate sender, its mail ends up in spam instead of disappearing.
p=reject: full protection
Mail that fails is rejected and never reaches the recipient. This is the goal: nobody can send email that appears to come from your domain. It is also required for BIMI (showing your logo next to your emails in Gmail and other providers).
A safe path to p=reject
- Make SPF and DKIM work first for every service that sends mail as you. Check SPF with our SPF Checker.
- Publish
p=nonewithruaand read the reports for 2–4 weeks. Use a DMARC report service or a dedicated mailbox; the XML reports are hard to read by hand. - Fix every legitimate sender that fails: add it to SPF, enable DKIM signing with your domain in its settings.
- Move to
p=quarantine. Optionally usepct=25, then 50 and 100 to roll out gradually. - Move to
p=rejectonce reports show only spoofing in the failures.
Common DMARC errors
- Record on the wrong name: DMARC must be published at
_dmarc.example.com, not on the root of the domain. - Multiple DMARC records: receivers ignore DMARC entirely when there is more than one.
- Missing or misplaced
v=DMARC1: it must be the very first tag. - Missing
ptag: the policy is required. ruawithoutmailto:: writerua=mailto:reports@example.com, not just the address.- Reports to another domain: if
ruapoints to a different domain, that domain must publish an authorization record, or reports are not sent. Report services set this up for you. - Forgetting subdomains:
sp=noneleaves subdomains open to spoofing even withp=rejecton the main domain.
Gmail, Yahoo and Microsoft requirements
Since February 2024, Gmail and Yahoo require bulk senders (more than 5,000 messages a day to their users) to have
SPF, DKIM and a DMARC record with at least p=none, with the From domain aligned. Microsoft introduced
similar rules for Outlook.com in 2025. Even small senders get better deliverability with DMARC in place, and every
domain benefits from the protection against spoofing.
Domains that do not send email
Parked domains and domains used only for websites are attractive to spammers precisely because nobody watches them. Protect them with two records:
example.com TXT "v=spf1 -all"
_dmarc.example.com TXT "v=DMARC1; p=reject"This tells every receiver that no mail from this domain is legitimate. You can verify both records with the DNS Lookup.