Learn · 6 minute read
What is DMARC, and how do you roll it out safely?
DMARC ties SPF and DKIM to the address people see in the From line, tells receivers what to do when a message fails, and sends you reports about who is sending as your domain.
What DMARC adds
SPF and DKIM each prove something about a technical identity, not necessarily the visible From address. DMARC says: a message passes only if SPF or DKIM passes and the domain that passed matches the From domain (this is called alignment). Then it tells receivers what to do with messages that do not pass.
It is published as a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@example.comThe three policies
p=none: monitor only. Receivers deliver as normal and send you reports. Start here.p=quarantine: receivers treat failures as suspicious, usually sending them to spam.p=reject: receivers refuse failures outright. This is the strongest protection against someone forging your domain.
A safe rollout
- Publish
p=nonewith a reporting address (rua=). Nothing changes for your mail. - Read the reports for a few weeks. They list every server that sent mail as your domain and whether it passed. You will find services you forgot about.
- Fix the legitimate senders that fail by setting up SPF or DKIM for them.
- Move to
p=quarantine, optionally withpct=25to apply it to a quarter of mail first, then raise it. - Move to
p=rejectonce only your own mail passes.
Why Gmail and Yahoo care
Since February 2024, Google and Yahoo require senders who send in bulk (Google defines this as more than 5,000 messages a day to Gmail addresses) to authenticate with SPF and DKIM, publish a DMARC record, offer one-click unsubscribe on marketing mail, and keep complaint rates low. Smaller senders are not exempt from the spirit of the rules: mail from a domain with no DMARC is easier to distrust.
You do not need p=reject to meet the requirement. A DMARC record with p=none is the minimum.
How to check yours
A DMARC record is easy to get slightly wrong: a missing p=, a policy that applies to only part of your mail, or no reporting address. Run your domain through the free domain checker to see it.
Common questions
What does p=none do?
It tells receivers to take no action on failures but to send you reports. It is the right first step: you learn who sends as your domain before anything can be blocked.
Where do DMARC reports go, and what do they look like?
To the address in rua=, as compressed XML files, usually once a day from each large receiver. They are hard to read raw, so many people use a DMARC reporting service to turn them into a table.
Will DMARC stop my own email being delivered?
Not at p=none. At quarantine or reject it can, if a legitimate sender of yours fails. That is why you read the reports and fix senders before tightening the policy.
Do subdomains need their own record?
No: a subdomain inherits the parent’s policy unless it has its own record, and you can set a different policy for subdomains with sp=.
Keep reading
- What is SPF, and how do you set it up?
- What is DKIM, and how do you set it up?
- Why your emails go to spam, and how to fix it
SendSend is an email API that checks these records for you and tells you when a domain is verified. Get started free.