What DMARC does
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the address people actually see in the From line. It tells receivers what to do when a message claiming to be from your domain fails both checks, and where to send reports about it.
It's published as a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=rThe tags that matter
| Tag | Meaning |
|---|---|
p= | Policy: none (monitor only), quarantine (send to spam) or reject (refuse). Required. |
rua= | Address for daily aggregate reports. Strongly recommended. |
sp= | Policy for subdomains, if different from p=. |
pct= | Share of failing mail the policy applies to, for gradual rollouts. |
adkim= / aspf= | Alignment mode: r (relaxed, the default) or s (strict). |
Moving from p=none to p=reject
- Publish
p=nonewith arua=address and wait two to four weeks. - Read the reports, or feed them to a free DMARC report reader. List every service that sends as your domain and fix SPF or DKIM for any that fail.
- Switch to
p=quarantine. If you want to be careful, addpct=25and raise it over a few weeks. - When nothing legitimate is failing, switch to
p=reject.
Build a record
Use the DMARC generator to create a record step by step, then check it here once it's published. To see how SPF and DKIM feed into DMARC, read the setup guide.