What is DMARC? How it works, and your first DMARC record

DMARC is a DNS record that tells receiving mail servers what to do with email that uses your domain in the From line but cannot prove it came from you, and asks them to send you daily reports about every server sending as your domain. It builds on SPF and DKIM: a message passes DMARC when one of them passes for the same domain the reader sees. Your first DMARC record is one TXT line at _dmarc.yourdomain, and it changes nothing about delivery until you decide it should.

This guide is for whoever looks after a domain's DNS, whether or not you run the mail server yourself. It covers what DMARC does, how a receiver decides pass or fail, what each tag means after the May 2026 update, and the exact record to publish today. DMARC is the last of three records; the SPF, DKIM and DMARC setup guide shows how the three fit together and the order to set them up in.

Quick answer

• What it is: a TXT record at _dmarc.example.com that starts with v=DMARC1.
• What it does: checks that the From domain passed SPF or DKIM (with matching domains), tells receivers what to do when it did not, and asks for reports.
• First record: v=DMARC1; p=none; rua=mailto:[email protected]. It only collects reports, so it cannot break your mail.
• Before that: have an SPF record and DKIM signing for every service that sends as you.
• After that: read the reports for 2 to 4 weeks, then move to p=quarantine and p=reject; the DMARC policy guide walks through it.
• Standard: RFC 9989 (May 2026) replaced RFC 7489. Existing records keep working; the pct tag is gone and t=y is new.

What does DMARC stand for?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. Each part of the name is one of its jobs:

• Authentication: it connects the results of SPF and DKIM to the domain your recipient actually sees.
• Reporting: receivers send you summaries of all mail that claimed to be from you.
• Conformance: you publish a policy, and receivers apply it to mail that fails.

It was first published in 2015 as RFC 7489, an informational document. In May 2026 the IETF published it as a Standards Track protocol in three parts: RFC 9989 for the policy record, RFC 9990 for aggregate reports and RFC 9991 for failure reports.

Why DMARC exists: the gap SPF and DKIM leave

Email has two sender addresses. The envelope sender (the Return-Path) is where bounces go, and it is what SPF checks. The From header is what your recipient sees, and neither SPF nor DKIM on its own checks it.

That leaves a gap. A scammer can send from their own server with their own envelope domain, pass SPF for that domain, and still put [email protected] in the From line. DKIM has the same gap: a message can carry a perfectly valid signature from d=scammer.example and a From address on your domain.

DMARC closes it with one rule, called alignment: SPF or DKIM must pass for the domain in the From line, not just for some domain.

How a receiver checks DMARC

For every incoming message, the receiving server:

1. Reads the domain in the From header, say example.com.
2. Looks up the TXT record at _dmarc.example.com. If there is none, it looks for one at the organisational domain (for news.example.com, that is example.com).
3. Checks SPF and DKIM as usual.
4. Decides whether either result is aligned:
   • SPF passes and the envelope sender domain matches the From domain, or
   • DKIM passes and the signing domain (d=) matches the From domain.
5. If at least one is aligned, the message passes DMARC. If not, it fails, and the receiver applies your policy.
6. Adds the result to the daily report it sends to your rua address.

"Matches" is relaxed by default: bounce.example.com aligns with example.com because they share an organisational domain. You can demand an exact match with aspf=s and adkim=s, but few domains need to.

What is in a DMARC record?

A DMARC record is a list of tag=value pairs separated by semicolons. Only v is strictly required, and it must come first; a record where it is missing or not first is ignored.

RFC 9989 lists p as recommended rather than required, and a record without it is treated as p=none. getReport's checker reads it that way too and adds a note; write p explicitly anyway, because receivers and checkers still following the old rules may treat the record as broken.

The old pct tag, which applied the policy to a percentage of failing mail, was removed because receivers applied it inconsistently. If your record still has pct=100, it does no harm; receivers that follow RFC 9989 ignore tags they do not know.

DMARC record examples

Every example below goes in one TXT record with the host name _dmarc. Your DNS panel adds the domain, so do not type _dmarc.example.com into a field that already shows example.com.

First record, monitoring only:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Quarantine, with a separate rule for subdomains:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; sp=reject; rua=mailto:[email protected]"

Full enforcement, including subdomains that do not exist:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; np=reject; rua=mailto:[email protected]"

A domain that never sends mail (a parked or redirect-only domain):

_dmarc.parked-example.com.  3600  IN  TXT  "v=DMARC1; p=reject"

Pair the last one with the SPF record v=spf1 -all, which says no server may send for the domain.

Reports to an address on another domain. If rua points outside your domain, for example to a report service, the receiving domain must publish a record allowing it, at example.com._report._dmarc.reports.example.net with the value v=DMARC1. Report services set this up for you; if you use your own second domain, add it yourself, or the reports never arrive.

How to publish your first DMARC record

1. Check SPF and DKIM first. DMARC has nothing to evaluate without them. Your main mailbox provider (Google Workspace, Microsoft 365) should pass both; the SPF record guide and the DKIM guide cover each.
2. Pick a report address. A dedicated mailbox such as [email protected] works; a busy domain gets dozens of zipped XML files a day, so a free DMARC report reader is easier to live with.
3. Add the record. In your DNS panel, create a TXT record, host _dmarc, value v=DMARC1; p=none; rua=mailto:[email protected]. Keep the default TTL.
4. Check there is only one. If _dmarc already has a record, edit it instead of adding a second. With two DMARC records, receivers discard both.
5. Wait and verify. New records usually appear within minutes; allow up to the TTL of any old record. Then run the check below.

The email and DNS health check reads _dmarc.yourdomain, reports the policy and tags it finds, and flags duplicate records or an unknown policy. The same run checks SPF and looks for DKIM, so you see all three at once.

Reading your first reports

Aggregate reports start arriving within a day or two. Each one comes from a single receiver (Google, Microsoft, Yahoo and others) and lists, per sending IP address, how many messages used your domain and whether SPF and DKIM passed and aligned.

Sort what you see into three groups:

• Your services, passing. Nothing to do.
• Your services, failing. A newsletter tool, shop or helpdesk that sends as you without DKIM for your domain. Turn DKIM on in that service.
• Servers you do not know. Either a forgotten tool or someone spoofing you. Look up who owns the IP address before deciding.

When only the first and last groups are left, your domain is ready to enforce. The SPF, DKIM and DMARC setup guide shows what a report record looks like.

What DMARC does not do

• It does not stop lookalike domains. DMARC protects example.com, not examp1e.com or example-support.com. Those need their own monitoring.
• It does not filter spam in general. It only answers "is this really from the domain in the From line?"
• p=none protects nobody. It is a monitoring stage. Scanners report it as "DMARC quarantine/reject policy not enabled" until you move up; see the DMARC policy guide.
• It does not guarantee inbox placement. Passing DMARC is a minimum. Reputation and complaint rates still decide the rest.

Why it matters now

Since February 2024, Google and Yahoo require a DMARC record (at least p=none) from bulk senders, meaning anyone sending close to 5,000 or more messages a day to their users. Microsoft applied the same rule to Outlook.com, Hotmail and Live addresses on 5 May 2025. Smaller senders are not strictly required to have one, but a domain without DMARC is an easier target for phishing that uses your name, and DMARC is also the entry ticket for BIMI, which shows your logo in the inbox.

Common mistakes

• Two records at _dmarc. Often one from an old provider and one from a new setup. Merge them into one.
• The record at the wrong host. Typing the full name into a panel that appends the domain creates _dmarc.example.com.example.com.
• v=DMARC1 not first, or written as v=DMARC 1. The whole record is ignored.
• Commas instead of semicolons between tags. Multiple rua addresses are separated by commas; tags by semicolons.
• Jumping straight to p=reject. The first sign of a forgotten sender is then customers not receiving invoices.

Questions people ask

What is DMARC?

DMARC is a DNS record that tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM: deliver it (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It also asks receivers to send you daily reports of every server using your domain. Publish it at _dmarc.yourdomain, starting with p=none.

What is a DMARC record?

A DMARC record is a TXT record at _dmarc.yourdomain that starts with v=DMARC1, followed by the policy and a report address, for example v=DMARC1; p=none; rua=mailto:[email protected]. Receivers read it after checking SPF and DKIM. One record per domain; with a second one, receivers discard both and act as if you had none.

What does DMARC stand for?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. First published as RFC 7489 in 2015 and updated as a Standards Track protocol in RFC 9989 in May 2026, it builds on SPF and DKIM: it checks that the visible From domain passes one of them, tells receivers what to do when it does not, and sends you reports.

Where do I add a DMARC record?

At your DNS provider, the same place as your other DNS records: often your domain registrar, Cloudflare or your web host. Create a TXT record with the host name _dmarc and the record as the value. Do not add it in your email provider's settings unless that provider also hosts your DNS; receivers look it up in public DNS.

Does DMARC stop spam?

No, not spam in general. DMARC stops mail that forges your exact domain in the From line, once your policy is quarantine or reject. Spam from other domains, including lookalikes such as examp1e.com, is untouched. What it does well is protect your customers from phishing that uses your name and stop your domain's reputation from being spent by someone else.

What changed in DMARC in 2026?

In May 2026 the IETF replaced RFC 7489 with RFC 9989, 9990 and 9991. The pct tag was removed, a t=y testing flag was added, np sets a policy for subdomains that do not exist, and receivers find the organisational domain with a DNS tree walk. Records still start with v=DMARC1, and existing ones keep working without changes.

Do I need DMARC if I only send a few emails?

Yes, it is worth having even if no rule forces you. The bulk-sender rules at Gmail, Yahoo and Outlook only require DMARC above about 5,000 messages a day, but anyone can forge a small company's domain. A p=none record costs five minutes and gives you reports; moving to p=reject later is what actually stops the forgeries.