DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails SPF and DKIM alignment, and asks them to send aggregate and forensic reports back to the domain owner.
A correct example#
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-rua@example.com; adkim=s; aspf=s; pct=100"Every element is there for a reason, and each maps to one of the setup steps below.
What good looks like#
- Done: Confirm SPF and DKIM are deployed and aligned for every legitimate sender.
- Done: Publish _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to begin collecting reports.
- Done: Analyze aggregate (RUA) reports for 2 to 4 weeks to identify unauthenticated legitimate sources.
- Done: Fix each source, then move to p=quarantine with pct=25, ramping to 100.
- Done: Move to p=reject and add sp=reject to cover subdomains.
What bad looks like#
- Seen in audits: Jumping straight to p=reject and blocking your own invoicing or HR system.
- Seen in audits: Sending RUA reports to a mailbox nobody reads; use a report processor.
- Seen in audits: Leaving subdomains uncovered because sp= was never set.
- Seen in audits: Assuming p=none provides protection; it is monitoring only.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
What is DMARC alignment?
The domain in the visible From header must match (exactly or organizationally) the domain that passed SPF or DKIM. Set adkim=s and aspf=s for strict matching.
How long until I can reach p=reject?
Typically 4 to 12 weeks depending on how many third-party senders you have to fix.
What are RUA and RUF reports?
RUA are daily aggregate XML reports of pass/fail counts per source. RUF are per-message forensic samples; many receivers no longer send them.