What DMARC does that SPF and DKIM cannot#
SPF and DKIM each answer a narrow question. SPF asks whether the connecting server is allowed to send for the Return-Path domain. DKIM asks whether a signature verifies for the signing domain. Neither checks the domain a human actually sees in the From header. An attacker can pass both while displaying your brand.
DMARC closes that gap with alignment: the From header domain must match the domain that passed SPF or DKIM. Then it adds two things nobody else provides: a policy the receiver should apply on failure, and reports back to you about everything claiming your domain.
The record, tag by tag#
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-rua@example.com; adkim=s; aspf=s; pct=100"- v=DMARC1 identifies the record. It must be first.
- p= is the policy for the domain itself: none (monitor), quarantine (spam folder), or reject (refuse).
- sp= is the policy for subdomains. Leave it out and subdomains inherit p=, but setting it explicitly avoids surprises.
- rua= is where daily aggregate XML reports go. Use a dedicated mailbox or a report processor.
- adkim= and aspf= set alignment to strict (s, exact domain match) or relaxed (r, organizational domain match). Relaxed is the default.
- pct= applies the policy to a percentage of failing mail, which is how you ramp from quarantine to full enforcement.
Why p=none is not protection#
A p=none record satisfies the letter of Gmail's bulk sender requirements and gives you reports, but it tells receivers to deliver spoofed mail normally. Treat it as the first week of a project, not the finish line. Domains that sit at p=none for years are the ones that show up in phishing campaigns.
How to reach enforcement without breaking your own mail#
- Confirm SPF and DKIM are deployed for every legitimate sender, and that each aligns with your From domain (DKIM d= is the reliable path for vendors).
- Publish p=none with rua= and collect reports for two to four weeks.
- Read the reports with an analyzer. Name every source IP range. Anything legitimate that fails needs its alignment fixed; anything unknown at volume is spoofing.
- Move to p=quarantine; pct=25 and watch for complaints from internal teams about missing mail. Ramp to pct=100 over two weeks.
- Move to p=reject, add sp=reject, and keep reading reports. New vendors will appear.
Why Gmail, Yahoo, and BIMI care#
Since February 2024, Gmail and Yahoo require senders of 5,000 or more messages a day to publish a DMARC record and align the From domain. Enforcement started with temporary errors and has tightened since. Separately, BIMI, the standard that puts your logo in the inbox, requires p=quarantine or p=reject. So DMARC enforcement is now both a compliance requirement and a brand feature.
Common failure modes#
- A vendor signs DKIM with its own domain (d=vendor.com). DKIM passes, alignment fails, your mail is quarantined. Fix: configure a custom DKIM domain with the vendor.
- Forwarding rewrites the Return-Path and modifies the body, so SPF and DKIM both fail. ARC lets large receivers override the failure; you cannot fix it from the sending side.
- Two DMARC records on one domain. Receivers treat this as no record.
- Reports going to an unmonitored mailbox. You reach p=reject blind, or never reach it.
Frequently asked questions#
What is DMARC alignment?
The domain in the visible From header must match the domain that passed SPF (Return-Path) or DKIM (d= tag), either exactly (strict) or at the organizational-domain level (relaxed).
How long does it take to get to p=reject?
Four to twelve weeks for most organizations, mostly spent identifying and fixing third-party senders.
Does DMARC affect deliverability?
Yes, positively. Aligned, authenticated mail builds domain reputation that follows you across infrastructure, and enforcement is a prerequisite for BIMI.
What are RUA and RUF reports?
RUA are daily aggregate XML reports of pass and fail counts per source. RUF are per-message forensic samples that most large providers no longer send.
Do I need DMARC on domains that never send email?
Yes. Publish v=DMARC1; p=reject with SPF v=spf1 -all so parked domains cannot be spoofed.