Beamfar
Sign inStart the 14-day trial

What is DMARC?

Last updated .

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy published as a TXT record at _dmarc.example.com. It tells receiving servers how to treat a message that claims to come from the domain but fails SPF or DKIM alignment, and where to send reports. RFC 7489 describes it.

Definition
DMARC
A DNS policy that tells receiving servers what to do with email that fails SPF or DKIM alignment: monitor, quarantine or reject.

The policy values

p=none asks receivers only to report. p=quarantine asks them to treat failing mail with suspicion, typically by delivering it to spam. p=reject asks them to refuse it. Moving from none to reject is a sensible hardening path once reports show that legitimate mail passes.

Why it matters for DNS changes

With a strict policy, a small mistake in SPF or DKIM becomes rejected mail. Do not tighten DMARC and change DNS on the same day, and read the aggregate reports before raising the policy.

An example

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" asks receivers only to report and to send aggregate reports to that address. When the reports show that every legitimate source passes, move to p=quarantine and later p=reject. A new newsletter tool added without SPF or DKIM set up would then fail, so list every sending service before tightening. Check the record with dig TXT _dmarc.example.com +short.

Aggregate reports arrive as XML files from the large mailbox providers, often compressed. Reading them by hand is tedious, so many agencies use a report reader; either way, look for sending sources you do not recognise before raising the policy.

What to check

The current policy, the address that receives reports and a test message that shows dmarc=pass.

Sources

Read on . Standards and vendor pages change; confirm the current text before you rely on it.

Guides that use this term

  • SPFSPF is a DNS record listing the servers allowed to send email for a domain. The one-record rule, the ten-lookup limit and the mistakes that make mail fail.
  • DKIMDKIM adds a cryptographic signature to outgoing email, verified with a public key in DNS. Where the key lives and what happens when the selector record is removed.
  • MX recordAn MX record lists the mail servers for a domain with priorities. What happens to email when it is missing or points to the wrong provider.

Know first. Know why. Tell your client before they call.

Paste your client list. Both regions start checking.

Start the 14-day trialWhat Beamfar watches

No card for the trial.