What DMARC does

How it works

DMARC checks two things: whether SPF or DKIM passed and whether the domain checked matches the sender address in the “From” field. This match is called alignment. If both fail, your policy applies.

The record is a TXT at _dmarc.<your domain>:

v=DMARC1; p=none; rua=mailto:dmarc@your-domain.example

The policy p has three stages:

1. p=none: nothing changes in delivery. Through rua you receive daily reports on who sends in your name.
2. p=quarantine: mails that fail go to spam.
3. p=reject: mails that fail are rejected.

What matters

• quarantine or reject in the end. Only then does DMARC protect your domain from forgeries; p=none only watches.
• pct at 100. With pct=25 the policy applies to only part of the mails. In the end pct should be 100 or absent.
• Reports to a foreign domain. The target domain must agree, with a record at <your domain>._report._dmarc.<target domain>.
• Subdomains. Without sp= the policy also applies to subdomains. sp=none opens them again.
• DKIM with your own domain. Forwarding and mailing lists break SPF; then only DKIM carries.

How to set it up

1. Create the record with p=none and an address for reports in the DNS settings of your domain, yourself or through your agency.
2. Evaluate the reports for two to four weeks. For every legitimate source, set up SPF and DKIM with your domain.
3. Switch to quarantine, later to reject. With pct you can make the switch in steps.