DMARC explained: policies, reports and a safe rollout

What DMARC adds to SPF and DKIM

SPF checks the envelope sender, and DKIM checks whichever domain signed the message. Neither looks at the address your recipients actually see in the From: header - so on their own, they don't stop someone from sending mail "from" your domain. DMARC (RFC 7489) closes that gap. It requires that at least one of SPF and DKIM passes for a domain that matches the From: domain, lets you publish a policy for mail that doesn't, and gives you reports about who is sending mail in your name.

The DMARC record

DMARC is a single TXT record on the _dmarc name of your domain:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Like SPF, a domain may have only one DMARC record; with two, receivers ignore both. A policy on the main domain also covers its subdomains unless you set sp=.

The three policies

• p=none - monitor only. Failing mail is delivered as usual, and you receive reports. Useful for a few weeks while you find your senders, but it gives no protection against spoofing.
• p=quarantine - mail that fails DMARC should be treated as suspicious, which in practice usually means the spam folder.
• p=reject - mail that fails DMARC should be refused outright. The strongest protection for your brand and your recipients.

Receivers treat the policy as a strong request rather than a command, but large mailbox providers do follow it.

Alignment: the part people miss

DMARC passes when either of these is true:

• SPF passes, and the envelope sender's domain matches the From: domain, or
• DKIM passes, and the signature's d= domain matches the From: domain.

With relaxed alignment (the default), "matches" means the same organizational domain, so mail.example.com aligns with example.com. Strict alignment requires an exact match. This is why a third-party tool can pass SPF and DKIM and still fail DMARC: it authenticates with its own domain. To align it, configure the service to sign with DKIM for your domain (most offer a "custom domain" or "domain authentication" setting) or to use a bounce address on your domain.

Reading DMARC reports

Aggregate reports (rua)

Receivers that support DMARC send a daily XML summary to the rua address: which IP addresses sent mail using your domain, how many messages, and whether SPF, DKIM and alignment passed. They contain no message content and are the main tool for a rollout. Raw XML is hard to read, so most people feed it into a report viewer. If the address is on another domain, that domain must publish an authorization record (for example example.com._report._dmarc.reports.example.net).

Failure reports (ruf)

Failure reports describe individual failing messages and may include headers or parts of the content. Many large providers don't send them at all, and because they can contain personal data, think about whether you need them - under the GDPR, collecting them is processing of personal data like any other.

A safe rollout path

1. Inventory your senders. Your mailbox provider, newsletter tool, invoicing system, web shop, CRM, helpdesk - anything that sends as your domain.
2. Authenticate each one. Add them to your single SPF record and set up DKIM signing with your domain wherever the service offers it.
3. Monitor. Publish p=none with a rua address and read the reports for two to four weeks. Fix every legitimate source that fails alignment.
4. Quarantine. Move to p=quarantine. If you are cautious and your receivers honor it, pct= lets you start with part of the traffic.
5. Reject. Once the reports stay clean, switch to p=reject and keep reading reports occasionally - new tools get added and forgotten.

A domain that never sends mail can skip straight to v=DMARC1; p=reject, together with an SPF record of v=spf1 -all.

DMARC at AnyMail

AnyMail's DNS check requires an enforcing policy: p=quarantine or p=reject. A record with p=none fails the check exactly as if there were no record, because a monitoring-only policy doesn't protect your domain from being spoofed. The dashboard suggests v=DMARC1; p=quarantine, and you are free to add rua reporting or tighten it to p=reject.

If other services already send mail as your domain, run the monitoring phase described above before connecting the domain, so the enforcing policy doesn't push their mail into spam. For a new domain, or one that only sends through AnyMail, you can publish the enforcing policy straight away - AnyMail signs every message with your domain's DKIM key, so its mail aligns.

You can check your current record with dig TXT _dmarc.example.com +short or the email authentication checker.