DMARC is an email authentication protocol that builds upon SPF and DKIM to prevent phishing, email spoofing, and business email compromise.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an open email security protocol standardized in RFC 7489. Working on top of two foundational email authentication mechanisms—SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail)—DMARC enables domain owners to specify how receiving mail servers (such as Gmail, Microsoft 365, and Yahoo Mail) should handle incoming emails that fail authentication checks, while generating structured aggregate feedback reports back to the sender.
Validate and diagnose your domain's DMARC, SPF, and DKIM records with our client-side DMARC Checker tool.
| Specification | Details |
|---|---|
| Standard Reference | IETF RFC 7489 |
| DNS Record Type | DNS TXT record |
| Record Hostname | _dmarc.yourdomain.com |
| Prerequisites | Sender Policy Framework (SPF - RFC 7208) and DKIM (RFC 6376) |
| Enforcement Policies | p=none (Monitoring), p=quarantine (Spam folder), p=reject (Discard) |
| Industry Mandates | Required by Google & Yahoo since 2024 for all bulk email senders |
+──────────────────────────────────────────────────────────+
│ DMARC Policy │
│ (Enforces Alignment & Declares Disposition) │
+─────────────────────────────┬────────────────────────────+
│
┌───────────────┴───────────────┐
▼ ▼
+──────────────+ +──────────────+
│ SPF Check │ │ DKIM Check │
│ (IP White- │ │ (Crypto Sig- │
│ list) │ │ nature) │
+──────────────+ +──────────────+
DKIM-Signature) to every outgoing email, verifying that content was not tampered with in transit.A DMARC record is published as a DNS TXT record at the subdomain _dmarc.example.com:
v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; pct=100; adkim=s; aspf=s;
| Tag | Name | Purpose | Example Values |
|---|---|---|---|
v |
Version | Identifies protocol version (must be DMARC1). |
v=DMARC1 |
p |
Policy | Action to take when email fails authentication. | none, quarantine, reject |
rua |
Aggregate Reports | URI where daily XML aggregate reports should be sent. | mailto:[email protected] |
ruf |
Forensic Reports | URI for immediate individual failure forensic reports. | mailto:[email protected] |
sp |
Subdomain Policy | Policy applied specifically to subdomains. | reject |
pct |
Percentage | Percentage of failing emails to which the policy applies. | 100 (100% of messages) |
adkim |
DKIM Alignment | Alignment mode for DKIM (r = relaxed, s = strict). |
s |
aspf |
SPF Alignment | Alignment mode for SPF (r = relaxed, s = strict). |
s |
Moving directly to p=reject on day one risks dropping legitimate corporate emails (e.g., from Salesforce, Zendesk, or Google Workspace). Security teams follow a 3-stage rollout:
p=none): Deploy for 4–8 weeks. Analyze aggregate XML reports (rua) to identify all third-party services sending email on your behalf.p=quarantine; pct=20 to pct=100): Deliver unauthenticated messages to the recipient's Spam/Junk folder.p=reject): Instruct global mail providers to outright discard any spoofed or unauthorized email before it reaches recipient inboxes.To protect consumer inboxes against the epidemic of impersonation, phishing scams, and ransomware, both Google and Yahoo mandated that any sender delivering over 5,000 emails daily must have SPF, DKIM, and a valid DMARC record configured, or messages will be blocked.
In relaxed alignment (r, the default), subdomains match the root domain (e.g., news.example.com aligns with example.com). In strict alignment (s), the sending domain in the email header must be an exact character-for-character match with the authenticated domain.
Run your domain through our DMARC Checker to verify syntax, policy enforcement level, and report routing addresses.
Free, browser-based utilities to test, generate, and inspect DMARC (Domain-based Message Authentication) payloads directly.