What is DMARC?
DMARC is a DNS record that tells mail servers what to do with email that claims to be from your domain but can't prove it. Here's how it works and how to set it up safely.
Free, no account needed.
The problem DMARC solves
Email was designed without any way to prove who sent a message. The From address is just text, so anyone can send mail that appears to come from your domain. That is how most phishing works.
SPF and DKIM were added to fix this, but on their own they don't check the From address people actually see, and they don't tell receivers what to do when a check fails. DMARC ties them together.
How DMARC works
When a message arrives, the receiving server checks SPF and DKIM. DMARC then asks one more question: does the domain that passed match the domain in the From address? This is called alignment. If at least one of SPF or DKIM passes and is aligned, the message passes DMARC.
If it fails, the receiver looks up your DMARC record at _dmarc.yourdomain and follows your policy:
- p=none: deliver it normally, but include it in reports.
- p=quarantine: treat it as suspicious, usually by putting it in spam.
- p=reject: refuse it.
Receivers also send daily aggregate reports to the address in your rua= tag, listing every source that sent mail as your domain and how it did.
SPF, DKIM and DMARC together
- SPF lists the servers allowed to send for your domain. It checks the envelope sender (Return-Path).
- DKIM adds a cryptographic signature to each message, tied to a domain in the d= tag.
- DMARC requires one of them to pass for the same domain as the visible From address, and tells receivers what to do otherwise.
Setting up DMARC step by step
- Make sure SPF and DKIM are set up for every service that sends as your domain: your mailbox provider, CRM, newsletter tool, billing system and so on.
- Publish a monitoring record: v=DMARC1; p=none; rua=mailto:your-report-address.
- Read the reports for a few weeks. Find every legitimate sender and fix any that fail alignment.
- Move to p=quarantine, optionally with pct= to start with a share of your mail.
- When reports show only unwanted mail failing, move to p=reject.
Why now
Since February 2024, Google and Yahoo require bulk senders to publish a DMARC record, and Microsoft introduced similar requirements for Outlook.com in 2025. Beyond the requirements, an enforcing DMARC policy protects your customers from phishing in your name and is a prerequisite for showing your logo with BIMI.
Frequently asked questions
Will DMARC block my own email?
Not at p=none, which only collects reports. It can at quarantine or reject if a legitimate service isn't set up with aligned SPF or DKIM, which is why you read reports before enforcing.
Do I need DMARC if I don't send much email?
Yes. Attackers target domains regardless of how much they send. Domains that never send email should publish p=reject so nobody can use them.
How long does it take to reach p=reject?
For a small organization, often a few weeks. Larger ones with many sending services can take a few months.
Related tools
- DMARC CheckerLook up a domain's DMARC record and see exactly what it does: the policy, where reports go, and what to fix.
- DMARC Record GeneratorBuild a correct DMARC record in a few clicks, then copy it into your DNS.
- DMARC Report AnalyzerDMARC reports are XML files most people never read. dmarcful turns them into a clear picture of everyone sending email as your domain, and tells you what to fix.
- SPF Record CheckerValidate a domain's SPF record, expand every include and see how close it is to the 10-DNS-lookup limit.
- DKIM Record CheckerLook up a DKIM public key and check its type, length and syntax. Don't know the selector? Leave it blank and we'll try the common ones.