# What is DMARC? How it works, and your first DMARC record > DMARC is the DNS record that tells mail servers what to do with email that pretends to be from your domain, and sends you reports about who uses it. How it works, and the record to publish first. Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/what-is-dmarc DMARC is a DNS record that tells receiving mail servers what to do with email that uses your domain in the From line but cannot prove it came from you, and asks them to send you daily reports about every server sending as your domain. It builds on SPF and DKIM: a message passes DMARC when one of them passes for the same domain the reader sees. Your first DMARC record is one TXT line at `_dmarc.yourdomain`, and it changes nothing about delivery until you decide it should. This guide is for whoever looks after a domain's DNS, whether or not you run the mail server yourself. It covers what DMARC does, how a receiver decides pass or fail, what each tag means after the May 2026 update, and the exact record to publish today. DMARC is the last of three records; the [SPF, DKIM and DMARC setup guide](https://getreport.app/guides/spf-dkim-dmarc-email-authentication) shows how the three fit together and the order to set them up in. ## Quick answer - **What it is:** a TXT record at `_dmarc.example.com` that starts with `v=DMARC1`. - **What it does:** checks that the From domain passed SPF or DKIM (with matching domains), tells receivers what to do when it did not, and asks for reports. - **First record:** `v=DMARC1; p=none; rua=mailto:dmarc@example.com`. It only collects reports, so it cannot break your mail. - **Before that:** have an [SPF record](https://getreport.app/guides/spf-record) and [DKIM signing](https://getreport.app/guides/what-is-dkim) for every service that sends as you. - **After that:** read the reports for 2 to 4 weeks, then move to `p=quarantine` and `p=reject`; the [DMARC policy guide](https://getreport.app/guides/dmarc-policy-none-quarantine-reject) walks through it. - **Standard:** RFC 9989 (May 2026) replaced RFC 7489. Existing records keep working; the `pct` tag is gone and `t=y` is new. ## What does DMARC stand for? DMARC stands for Domain-based Message Authentication, Reporting and Conformance. Each part of the name is one of its jobs: - **Authentication:** it connects the results of SPF and DKIM to the domain your recipient actually sees. - **Reporting:** receivers send you summaries of all mail that claimed to be from you. - **Conformance:** you publish a policy, and receivers apply it to mail that fails. It was first published in 2015 as RFC 7489, an informational document. In May 2026 the IETF published it as a Standards Track protocol in three parts: RFC 9989 for the policy record, RFC 9990 for aggregate reports and RFC 9991 for failure reports. ## Why DMARC exists: the gap SPF and DKIM leave Email has two sender addresses. The envelope sender (the `Return-Path`) is where bounces go, and it is what SPF checks. The From header is what your recipient sees, and neither SPF nor DKIM on its own checks it. That leaves a gap. A scammer can send from their own server with their own envelope domain, pass SPF for _that_ domain, and still put `invoices@yourcompany.com` in the From line. DKIM has the same gap: a message can carry a perfectly valid signature from `d=scammer.example` and a From address on your domain. DMARC closes it with one rule, called **alignment**: SPF or DKIM must pass _for the domain in the From line_, not just for some domain. ## How a receiver checks DMARC For every incoming message, the receiving server: 1. Reads the domain in the From header, say `example.com`. 2. Looks up the TXT record at `_dmarc.example.com`. If there is none, it looks for one at the organisational domain (for `news.example.com`, that is `example.com`). 3. Checks SPF and DKIM as usual. 4. Decides whether either result is **aligned**: - SPF passes and the envelope sender domain matches the From domain, or - DKIM passes and the signing domain (`d=`) matches the From domain. 5. If at least one is aligned, the message passes DMARC. If not, it fails, and the receiver applies your policy. 6. Adds the result to the daily report it sends to your `rua` address. "Matches" is relaxed by default: `bounce.example.com` aligns with `example.com` because they share an organisational domain. You can demand an exact match with `aspf=s` and `adkim=s`, but few domains need to. > **Note:** > RFC 9989 finds the organisational domain with a "DNS tree walk": the receiver queries `_dmarc` records up the name, one label at a time, instead of relying on the Public Suffix List as RFC 7489 did. For ordinary domains the result is the same. ## What is in a DMARC record? A DMARC record is a list of `tag=value` pairs separated by semicolons. Only `v` is strictly required, and it must come first; a record where it is missing or not first is ignored. | Tag | What it sets | Values and default | | ---------------- | --------------------------------------- | --------------------------------------------------------- | | `v` | Version | `DMARC1`, always first | | `p` | Policy for the domain | `none`, `quarantine` or `reject` | | `sp` | Policy for subdomains | Same values; defaults to `p` | | `np` | Policy for subdomains that do not exist | Same values; defaults to `sp`, then `p` (new in RFC 9989) | | `rua` | Where aggregate reports go | One or more `mailto:` addresses | | `ruf` | Where failure reports go | `mailto:` addresses; few receivers send them | | `adkim` / `aspf` | Alignment mode for DKIM / SPF | `r` relaxed (default) or `s` strict | | `t` | Testing flag | `y` or `n` (default); new in RFC 9989 | | `fo` | When to send failure reports | `0` (default), `1`, `d`, `s` | | `psd` | Marks a public suffix domain | For registries only; leave it out | RFC 9989 lists `p` as recommended rather than required, and a record without it is treated as `p=none`. getReport's checker reads it that way too and adds a note; write `p` explicitly anyway, because receivers and checkers still following the old rules may treat the record as broken. The old `pct` tag, which applied the policy to a percentage of failing mail, was removed because receivers applied it inconsistently. If your record still has `pct=100`, it does no harm; receivers that follow RFC 9989 ignore tags they do not know. ## DMARC record examples Every example below goes in one TXT record with the host name `_dmarc`. Your DNS panel adds the domain, so do not type `_dmarc.example.com` into a field that already shows `example.com`. **First record, monitoring only:** ```dns _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" ``` **Quarantine, with a separate rule for subdomains:** ```dns _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@example.com" ``` **Full enforcement, including subdomains that do not exist:** ```dns _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; np=reject; rua=mailto:dmarc@example.com" ``` **A domain that never sends mail** (a parked or redirect-only domain): ```dns _dmarc.parked-example.com. 3600 IN TXT "v=DMARC1; p=reject" ``` Pair the last one with the SPF record `v=spf1 -all`, which says no server may send for the domain. **Reports to an address on another domain.** If `rua` points outside your domain, for example to a report service, the receiving domain must publish a record allowing it, at `example.com._report._dmarc.reports.example.net` with the value `v=DMARC1`. Report services set this up for you; if you use your own second domain, add it yourself, or the reports never arrive. ## How to publish your first DMARC record 1. **Check SPF and DKIM first.** DMARC has nothing to evaluate without them. Your main mailbox provider (Google Workspace, Microsoft 365) should pass both; the [SPF record guide](https://getreport.app/guides/spf-record) and the [DKIM guide](https://getreport.app/guides/what-is-dkim) cover each. 2. **Pick a report address.** A dedicated mailbox such as `dmarc@example.com` works; a busy domain gets dozens of zipped XML files a day, so a free DMARC report reader is easier to live with. 3. **Add the record.** In your DNS panel, create a TXT record, host `_dmarc`, value `v=DMARC1; p=none; rua=mailto:dmarc@example.com`. Keep the default TTL. 4. **Check there is only one.** If `_dmarc` already has a record, edit it instead of adding a second. With two DMARC records, receivers discard both. 5. **Wait and verify.** New records usually appear within minutes; allow up to the TTL of any old record. Then run the check below. > **Free tool:** [DMARC, SPF, DKIM and MX record checker](https://getreport.app/tools/email-dns-check): Free DMARC checker that also tests SPF, DKIM and MX. See what is missing or broken and get the exact DNS records to add. No sign-up, results in seconds. The email and DNS health check reads `_dmarc.yourdomain`, reports the policy and tags it finds, and flags duplicate records or an unknown policy. The same run checks SPF and looks for DKIM, so you see all three at once. > **Check: The domain publishes a DMARC record.** Since February 2024, Gmail and Yahoo require DMARC from anyone who sends them more than 5,000 messages a day. DMARC also tells receivers what to do with mail that pretends to come from your exact domain. > > 1. Add a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:reports@yourdomain to start collecting reports. > 2. After a few weeks of clean reports, move to p=quarantine and then p=reject. > 3. If there are two or more DMARC records, merge them into one: receivers ignore all of them. > **Check: DMARC reports.** The aggregate reports (rua) are how you find every service that sends as your domain before you tighten the policy. Without them you are guessing. > > 1. Add rua=mailto:dmarc@yourdomain (or the address of a free DMARC report reader) to the DMARC record. ## Reading your first reports Aggregate reports start arriving within a day or two. Each one comes from a single receiver (Google, Microsoft, Yahoo and others) and lists, per sending IP address, how many messages used your domain and whether SPF and DKIM passed and aligned. Sort what you see into three groups: - **Your services, passing.** Nothing to do. - **Your services, failing.** A newsletter tool, shop or helpdesk that sends as you without DKIM for your domain. Turn DKIM on in that service. - **Servers you do not know.** Either a forgotten tool or someone spoofing you. Look up who owns the IP address before deciding. When only the first and last groups are left, your domain is ready to enforce. The [SPF, DKIM and DMARC setup guide](https://getreport.app/guides/spf-dkim-dmarc-email-authentication#how-do-dmarc-reports-work) shows what a report record looks like. ## What DMARC does not do - **It does not stop lookalike domains.** DMARC protects `example.com`, not `examp1e.com` or `example-support.com`. Those need their own monitoring. - **It does not filter spam in general.** It only answers "is this really from the domain in the From line?" - **`p=none` protects nobody.** It is a monitoring stage. Scanners report it as "DMARC quarantine/reject policy not enabled" until you move up; see the [DMARC policy guide](https://getreport.app/guides/dmarc-policy-none-quarantine-reject). - **It does not guarantee inbox placement.** Passing DMARC is a minimum. Reputation and complaint rates still decide the rest. ## Why it matters now Since February 2024, Google and Yahoo require a DMARC record (at least `p=none`) from bulk senders, meaning anyone sending close to 5,000 or more messages a day to their users. Microsoft applied the same rule to Outlook.com, Hotmail and Live addresses on 5 May 2025. Smaller senders are not strictly required to have one, but a domain without DMARC is an easier target for phishing that uses your name, and DMARC is also the entry ticket for [BIMI](https://getreport.app/guides/what-is-bimi), which shows your logo in the inbox. ## Common mistakes - **Two records at `_dmarc`.** Often one from an old provider and one from a new setup. Merge them into one. - **The record at the wrong host.** Typing the full name into a panel that appends the domain creates `_dmarc.example.com.example.com`. - **`v=DMARC1` not first**, or written as `v=DMARC 1`. The whole record is ignored. - **Commas instead of semicolons** between tags. Multiple `rua` addresses are separated by commas; tags by semicolons. - **Jumping straight to `p=reject`.** The first sign of a forgotten sender is then customers not receiving invoices. ## Questions people ask ### What is DMARC? DMARC is a DNS record that tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM: deliver it (`p=none`), send it to spam (`p=quarantine`) or refuse it (`p=reject`). It also asks receivers to send you daily reports of every server using your domain. Publish it at `_dmarc.yourdomain`, starting with `p=none`. ### What is a DMARC record? A DMARC record is a TXT record at `_dmarc.yourdomain` that starts with `v=DMARC1`, followed by the policy and a report address, for example `v=DMARC1; p=none; rua=mailto:dmarc@example.com`. Receivers read it after checking SPF and DKIM. One record per domain; with a second one, receivers discard both and act as if you had none. ### What does DMARC stand for? DMARC stands for Domain-based Message Authentication, Reporting and Conformance. First published as RFC 7489 in 2015 and updated as a Standards Track protocol in RFC 9989 in May 2026, it builds on SPF and DKIM: it checks that the visible From domain passes one of them, tells receivers what to do when it does not, and sends you reports. ### Where do I add a DMARC record? At your DNS provider, the same place as your other DNS records: often your domain registrar, Cloudflare or your web host. Create a TXT record with the host name `_dmarc` and the record as the value. Do not add it in your email provider's settings unless that provider also hosts your DNS; receivers look it up in public DNS. ### Does DMARC stop spam? No, not spam in general. DMARC stops mail that forges your exact domain in the From line, once your policy is `quarantine` or `reject`. Spam from other domains, including lookalikes such as `examp1e.com`, is untouched. What it does well is protect your customers from phishing that uses your name and stop your domain's reputation from being spent by someone else. ### What changed in DMARC in 2026? In May 2026 the IETF replaced RFC 7489 with RFC 9989, 9990 and 9991. The `pct` tag was removed, a `t=y` testing flag was added, `np` sets a policy for subdomains that do not exist, and receivers find the organisational domain with a DNS tree walk. Records still start with `v=DMARC1`, and existing ones keep working without changes. ### Do I need DMARC if I only send a few emails? Yes, it is worth having even if no rule forces you. The bulk-sender rules at Gmail, Yahoo and Outlook only require DMARC above about 5,000 messages a day, but anyone can forge a small company's domain. A `p=none` record costs five minutes and gives you reports; moving to `p=reject` later is what actually stops the forgeries.