The basics
What a DMARC record does
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with email that fails authentication, and where to send reports about it.
A message passes DMARC when SPF or DKIM passes and the domain it checked matches the From address people see. This is the record that actually stops someone sending email in your name, but only when its policy is set to quarantine or reject.
Example record · TXT at _dmarc.example.com
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com
Reject anything that fails, and send daily summary reports to that address. Most domains start at p=none, move to quarantine, then reject.
Reading the result
What each part of the record means
| You see | It means |
|---|---|
| v=DMARC1 | Marks the record as DMARC. It must come first. |
| p=none | Monitor only. Failing mail is still delivered, so this does not stop spoofing. |
| p=quarantine | Failing mail goes to spam or junk. |
| p=reject | Failing mail is refused. Full protection. |
| rua=mailto: | Where receivers send daily aggregate reports showing who sends as your domain. |
| sp= | Policy for subdomains. If missing, subdomains follow p=. |
| pct= | Applies the policy to a percentage of failing mail, for gradual rollouts. |
| adkim / aspf | Alignment mode. r (relaxed, the default) allows subdomains to match; s (strict) needs an exact match. |
Common problems
DMARC mistakes we see most
Stuck on p=none
p=none only collects reports. Many domains publish it and never move on, so fake email in their name is still delivered.
No reporting address
Without rua you can't see which services send as you, so moving to reject feels risky. Add a mailbox or a DMARC reporting service.
Record in the wrong place
DMARC must be a TXT record at _dmarc.yourdomain, not at the domain root. A record in the wrong place counts as no DMARC at all.
Senders not aligned
A service can pass SPF with its own domain but still fail DMARC. Set up DKIM signing with your domain in each sending service so its mail aligns.
Fixing it
How to fix your DMARC record
- Make sure SPF is valid and DKIM signing is on for your main mailbox provider.
- Publish v=DMARC1; p=none; rua=mailto:you@yourdomain as a TXT record at _dmarc.yourdomain.
- Read the reports for two to four weeks and fix SPF or DKIM for every legitimate sender that fails.
- Move to p=quarantine, watch for problems, then p=reject. Run this check again to confirm the grade.
Questions
DMARC FAQ
What is a DMARC record?
A TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with email that fails SPF and DKIM alignment (deliver, junk or reject) and where to send reports.
Is p=none enough?
No. p=none only monitors. Fake email in your name is still delivered. Use p=none to learn who sends for you, then move to quarantine and reject.
Do Google and Yahoo require DMARC?
Since February 2024, Google and Yahoo require bulk senders (over 5,000 messages a day to their users) to publish a DMARC record, at least p=none, along with SPF and DKIM.
Will p=reject block my own email?
Only if a legitimate sender fails both SPF and DKIM alignment. That is why you read DMARC reports at p=none first and fix each sender before enforcing.
More free checks
Checking domains for clients?
Inside Scan Hub the same check runs per client and produces a white-label PDF with the evidence behind every answer. Check again after the fix and the report shows the grade before and after.