What DMARC does
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the From address your recipients see. A message passes DMARC when SPF or DKIM passes and the domain it checked matches the From domain. That match is called alignment.
DMARC does two jobs. It tells receivers what to do with mail that fails (deliver it, send it to spam, or reject it), and it asks them to send you daily reports about every source sending as your domain. Those reports are how you find forgotten tools and spoofing. Our guide on how to read a DMARC aggregate report explains the format.
How to read a DMARC record
A DMARC record is a TXT record at _dmarc.yourcompany.com, for example v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r.
| Tag | What it sets | Common values |
|---|---|---|
| v | Version, must come first | DMARC1 |
| p | Policy for mail that fails | none, quarantine, reject |
| sp | Policy for subdomains | Same values as p, defaults to p |
| rua | Where aggregate reports are sent | mailto: address, one or more |
| ruf | Where failure samples are sent, few receivers send them | mailto: address |
| pct | Share of failing mail the policy applies to | 1 to 100, defaults to 100 |
| adkim / aspf | Alignment mode for DKIM and SPF | r (relaxed, default) or s (strict) |
The three policies explained
Most teams start at p=none, read reports until every legitimate sender passes, then move to quarantine and finally reject. Jumping straight to reject without reading reports usually blocks some of your own mail, often from a billing system or help desk nobody remembered.
- p=none means monitor only. Failing mail is delivered as usual, and you receive reports. This is the minimum Gmail, Yahoo and Microsoft require from bulk senders.
- p=quarantine asks receivers to put failing mail in spam.
- p=reject asks receivers to refuse failing mail outright. This is the strongest protection against people spoofing your domain.
How to check DMARC manually
-
1
Run
dig +short _dmarc.yourcompany.com TXT. You should get exactly one record starting with v=DMARC1. - 2 Check the p= value and make sure rua= points to a mailbox or service that reads XML reports.
- 3 If rua points to another domain, that domain must publish an authorization record, or reports are not sent.
-
4
Send a test message to Gmail, open Show original and look for
dmarc=pass. - 5 Confirm the SPF or DKIM domain in the headers matches your From domain.
Common DMARC problems
If DMARC fails while SPF and DKIM show pass, alignment is the usual cause. Check each with the SPF checker and the DKIM checker to see which domain each one uses.
- The record is at the root domain instead of _dmarc, so receivers never find it.
- Two DMARC records on the same name, which makes receivers ignore both.
- A missing semicolon or a smart quote copied from a document.
- p=reject with an email service that signs DKIM with its own domain, so its mail is rejected.
- A rua address that nobody reads, so problems go unnoticed for months.
DMARC and the bulk sender rules
Since February 2024, Gmail and Yahoo require anyone sending more than 5,000 messages a day to their users to publish DMARC with at least p=none, authenticate with both SPF and DKIM, and align the From domain with SPF or DKIM. They also require one-click unsubscribe on marketing mail and a spam rate below 0.3%. Since May 2025, Microsoft applies the same authentication rules to high volume senders to Outlook.com, Hotmail and Live addresses, and mail that does not comply can be rejected.
Reading the reports is where DMARC pays off
A DMARC record without anyone reading its reports gives you compliance but not insight. Aggregate reports arrive as XML files from every major receiver, usually daily, and are hard to read by hand. BlacklistMonitoring ingests them for you and turns them into a readable dashboard that shows pass and fail rates, every service sending as your domain (sender source discovery on Business and higher), and sources that look like spoofing. It alerts you when your record changes or a new source starts failing, so you can move to p=reject with confidence. Starter includes 50,000 report messages a month and Business 1,000,000. Learn more about DMARC monitoring and the DMARC report analyzer, or see the pricing page.
Frequently asked questions
How do I check my DMARC record?
Enter your domain in the checker above. It reads the TXT record at _dmarc on your domain and explains each setting. Manually, run dig _dmarc.yourdomain.com TXT and look for a record starting with v=DMARC1.
What DMARC policy should I use?
Start with p=none and a rua address to collect reports. Once every legitimate sender passes, move to p=quarantine and then p=reject. Reject gives the strongest protection against spoofing.
Is p=none enough for Gmail and Yahoo?
Yes, for the bulk sender requirements. Gmail, Yahoo and Microsoft require a DMARC record with at least p=none, plus SPF and DKIM and alignment. A stronger policy is still recommended to protect your domain from spoofing.
Why does DMARC fail when SPF passes?
SPF checks the Return-Path domain, which is often your email service's domain, not yours. If it does not match your From domain and DKIM does not align either, DMARC fails. Setting up custom DKIM usually fixes it.
Do I need DMARC if I do not send bulk email?
Yes. DMARC protects your domain from being spoofed in phishing, no matter how much mail you send. Domains that never send mail should publish p=reject so nobody can use them.