DMARC (Domain-based Message Authentication, Reporting and Conformance), defined by RFC 9989, builds on SPF and DKIM to tell receiving mail servers how to handle messages that claim to be from your domain but fail authentication.
You publish a single TXT record at _dmarc.yourdomain.com. It carries a policy in the p= tag: none (monitor only), quarantine (send to spam), or reject (block outright). A message passes DMARC when either SPF or DKIM passes and the authenticated domain aligns with the address in the visible From header.
The rua= tag requests RFC 9990 aggregate reports; ruf= requests privacy-sensitive failure reports. sp= and np= set subdomain policies, while t=y tests one policy level lower. RFC 9989 removed the former pct sampling tag. Only one applicable policy record is valid; duplicates at a lookup name cause that set to be discarded.
DMARC stops exact-domain spoofing and is a prerequisite for BIMI. Moving from none to reject safely takes evidence and staged test mode.
Check it on your domain
- DMARC Checker: look up and validate a domain's DMARC record and policy.
- DMARC Generator: build a valid DMARC record from a simple form.
- DMARC Report Analyser: read a DMARC aggregate (RUA) report in plain English.