How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
The mechanism
A policy that tells receivers what to do when authentication fails.
DMARC is published as a TXT record at
_dmarc.example.com. It requires that at least
one of SPF or DKIM both passes and aligns with the From
header domain. If neither does, the policy tells the
receiver what to do: nothing (p=none),
quarantine (p=quarantine), or reject
(p=reject).
v=DMARC1; p=reject; rua=mailto:dmarc@example.com; sp=rejectThe three policies
- p=noneMonitoring mode. Failures are reported but delivered. Good for learning what sends as your domain, but it protects nothing.
- p=quarantineFailures land in the spam folder. A middle step that catches spoofing without risking legitimate mail.
- p=rejectFailures are refused outright. The strongest protection, and the goal for every domain.
Aggregate reports
The rua tag tells receivers where to send
aggregate reports: XML files that list every source that
sent mail as your domain, with pass/fail counts. See
DMARC
aggregate reports for how to read them.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
dmarc_missing
|
No DMARC record |
dmarc_monitoring_only
|
DMARC monitoring only |
dmarc_quarantine_only
|
DMARC quarantine only |
dmarc_subdomains_unprotected
|
Subdomains unprotected by DMARC |
More guides
Keep reading.
How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.
DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.