DMARC is the record that makes SPF and DKIM actually protect your domain from spoofing. It ties those checks to the address recipients see, tells receivers what to do when a message fails, and sends you reports on who is mailing as you. You publish it as one TXT record at _dmarc. The DMARC record generator assembles the value; this guide covers the rollout that keeps your real mail flowing.
What DMARC adds
SPF and DKIM each check a domain, but not necessarily the one in the From header. DMARC closes that gap with alignment: it requires that the domain SPF or DKIM passed for matches the From domain a person sees. A message passes DMARC if it passes SPF or DKIM and is aligned.
It also gives you two things SPF and DKIM cannot: a policy that tells receivers what to do with failures, and reporting that reveals every source sending under your name, including the ones spoofing you.
The record and its tags
A DMARC record reads like this:
v=DMARC1; p=none; rua=mailto:[email protected]; pct=100- p is the policy:
noneto monitor,quarantineto send failures to spam,rejectto block them. - rua is the address for daily aggregate reports, the most important tag.
- sp sets a separate policy for subdomains, if you want one.
- adkim and aspf set alignment to relaxed (
r) or strict (s); relaxed is the safe default. - pct applies the policy to a percentage of mail, handy when ramping up enforcement.
Roll it out in three stages
The cardinal rule is to never start at reject. Move through three stages.
- Monitor with p=none. Publish the record with
p=noneand a workingruaaddress. This changes nothing about delivery but starts the reports flowing. Leave it for a few weeks. - Read the reports and fix senders. The aggregate reports list every IP sending as your domain and whether it passed SPF and DKIM. Use them to find legitimate services that are failing, and get each one authenticated. If you have not yet, publish SPF and DKIM for those senders first.
- Enforce with quarantine, then reject. Once the reports show only your real, aligned mail passing, move to
p=quarantine. Watch for a while, then step up top=reject. You can ease the transition withpct, applying enforcement to part of your mail at first.
Reading the reports
Aggregate reports arrive as zipped XML, one per receiver per day, which is hard to read by hand. The value is in the pattern: a source you recognize but that fails usually means a missing SPF include or an unsigned DKIM path, both fixable. A source you do not recognize is often someone spoofing you, which is exactly what enforcement will stop.
Where DMARC fits
DMARC is the keystone, but it only works on top of the other two records. How to create an SPF record covers authorizing your senders, and how to set up DKIM covers the signature that survives forwarding. Reaching an enforced DMARC policy is also the prerequisite for a BIMI record, which can show your brand logo in supporting inboxes.
Start now with the DMARC record generator: set p=none, add your reporting address, and publish. The reports will tell you what to fix before you tighten the policy.