Glossary

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Tells receiving servers what to do when SPF or DKIM checks fail

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email policy standard that builds on SPF and DKIM to let domain owners specify how unauthenticated mail should be handled and receive reports on email flows from participating mail receivers.

What is DMARC?

DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, is defined in RFC 7489. It gives domain owners control over what happens when email claiming to be from their domain fails SPF or DKIM authentication — and critically, when those results are not aligned with the header "From" address that recipients see.

A DMARC record is published as a DNS TXT record at "_dmarc.yourdomain.com." It specifies a policy — "none," "quarantine," or "reject" — and instructs receiving mail servers to send aggregate and forensic reports back to the domain owner. These reports reveal which sources are sending mail on behalf of your domain and how authentication is performing.

DMARC is widely considered the most important email authentication tool because it closes the spoofing gap that SPF and DKIM leave open individually. It also satisfies sending requirements from major mailbox providers like Google and Yahoo, who now mandate DMARC for bulk senders.

How Does DMARC Work?

DMARC introduces the concept of "identifier alignment." For a message to pass DMARC, it must pass either SPF or DKIM, and the authenticated domain must align with the "From" header domain. SPF alignment means the Return-Path domain matches the From domain; DKIM alignment means the "d=" domain in the DKIM signature matches the From domain.

If a message fails DMARC alignment, the receiving server checks the domain's DMARC policy tag "p=". With "p=none," no action is taken but reports are still sent. With "p=quarantine," failing messages are delivered to the spam folder. With "p=reject," the message is refused outright.

The "rua=" tag specifies where aggregate XML reports should be sent. These reports, which are delivered daily, contain data about every message that invoked DMARC evaluation, making it possible to identify unauthorised senders and gaps in your authentication setup.

How to Check Your DMARC Record

Use the DMARC Checker at nslookup.net/tools/dmarc-checker to validate your DMARC record. Enter your domain and the tool will retrieve the TXT record from "_dmarc.yourdomain.com," parse each tag, and highlight problems such as a missing "rua" address, an invalid policy value, or a misconfigured subdomain policy.

Checking your DMARC record is an important first step before tightening your policy from "none" to "quarantine" or "reject." The tool also shows the percentage tag "pct=," which controls what fraction of failing mail the policy is applied to.

Related Tool

DMARC Checker

Try the Tool →

Frequently Asked Questions

What is the difference between DMARC p=quarantine and p=reject?

With "p=quarantine," receiving mail servers are instructed to treat failing messages as suspicious and typically deliver them to the recipient's spam or junk folder. With "p=reject," receivers are told to refuse the message entirely, preventing it from reaching the inbox at all. Reject is the strongest protection but should only be used once you are confident all legitimate mail passes authentication.

Do I need both SPF and DKIM to use DMARC?

Technically DMARC requires only one of SPF or DKIM to pass with alignment. However, deploying both is strongly recommended. If one mechanism fails — for example, DKIM breaks due to email forwarding — the other can still save the message. Using only one mechanism leaves a single point of failure in your authentication chain.

What are DMARC aggregate reports?

DMARC aggregate reports (RUA) are XML files sent daily by participating mail receivers to the address specified in your "rua=" tag. Each report summarises all messages from a given source IP that invoked DMARC evaluation for your domain, including how many passed or failed SPF and DKIM, and what policy was applied. Analysing these reports is essential for understanding your email ecosystem before tightening your policy.

Does DMARC affect outbound email deliverability?

DMARC itself is an inbound policy — it tells receivers how to handle your email. However, having a DMARC record improves your domain's reputation with major providers and satisfies their sending requirements. Domains with no DMARC record may see lower deliverability as mailbox providers increasingly treat missing DMARC as a signal of lower trustworthiness.