Glossary · ENCheck a domain

DMARC

DMARC is an email domain policy that tells participating receiving systems how to evaluate mail claiming to come from a domain. It also states how the domain owner prefers failed authentication checks to be handled and where to send reports. A message passes DMARC when at least one domain verified by SPF or DKIM matches the domain in the visible From address under DMARC's matching rules, called alignment.

How do SPF and DKIM fit into DMARC?

SPF checks whether the sending system is authorized for a domain in the delivery information exchanged between mail servers (the SMTP envelope). DKIM checks a signature associated with a signing domain. DMARC compares a passing SPF or DKIM domain with the author domain shown in the message's From field. The domains must match under DMARC's strict or relaxed alignment rules.

For example, a message may pass SPF for a provider's domain but show From: alex@example.com. If the provider's domain does not align with example.com, SPF alone does not make that message pass DMARC. An aligned DKIM signature could still produce a DMARC pass.

What do DMARC policies do?

A domain publishes a DMARC policy in a DNS TXT record under _dmarc, such as _dmarc.example.com. The policy can request no special handling (p=none), quarantine (keeping mail out of the normal inbox for review), or rejection (refusing delivery) for messages that fail DMARC. These values express the domain owner's preference; each receiving system makes its own final delivery decision and may apply local rules.

Domain owners commonly begin in monitoring mode, review reports, and fix legitimate sending sources before asking receivers to quarantine or reject failures. A stricter policy can affect valid mail if a service is missing from authentication setup or if forwarding and mailing lists disrupt alignment.

What does a DMARC pass or failure tell you?

A pass means the visible author domain aligned with an SPF- or DKIM-authenticated domain under the published checks. It does not prove that a message is harmless or truthful. A failure can indicate spoofing, but it can also result from legitimate forwarding, a third-party sender that was not configured correctly, or message changes. DMARC reports help investigate; they are not a complete list of every message or a guarantee that every receiver followed the requested policy.

Related terms