Skip to content
Spamjadoo

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy record at _dmarc.domain that tells receiving servers what to do with a message whose visible From domain fails both SPF and DKIM alignment: nothing, quarantine it, or reject it. It also asks receivers to send the domain owner aggregate reports about who is sending as the domain. DMARC is defined in RFC 7489.

The record

_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=r"
TagMeaning
p=Policy for the domain: none, quarantine or reject. Required.
sp=Policy for subdomains. Defaults to p.
pct=Percentage of failing mail the policy applies to. Default 100.
rua=Where aggregate (daily XML) reports go.
ruf=Where per-message failure reports go. Few receivers send them.
adkim= / aspf=Alignment mode: r relaxed (subdomains match) or s strict (exact).

Alignment

DMARC passes when at least one of SPF or DKIM passes and its domain aligns with the From: header domain. SPF authenticates the envelope sender; DKIM authenticates the d= domain in the signature. Either one aligning is enough. This is what closes the gap where a spammer passes SPF for their own domain while showing yours in the From line.

From none to reject

  1. Publish p=none with a rua= address. Nothing changes for your mail; reports start arriving.
  2. Read the reports. Every legitimate source that fails needs adding to SPF or set up to sign with DKIM on your domain.
  3. Move to p=quarantine, optionally with a low pct=, and raise it.
  4. Set p=reject. Google, Yahoo and Microsoft now require at least p=none from bulk senders, and enforcement is what actually stops spoofing.

Use the DMARC checker to read any domain’s policy as a sentence.

DMARC and handshake rejection

The SPF half of DMARC is known at MAIL FROM. When a domain publishes p=reject and the connecting server fails SPF for it, Spamjadoo can refuse the message during the session unless the policy allows for a later DKIM rescue. The DKIM half is evaluated after DATA for the traffic that gets that far.

Last reviewed 10 September 2026 by Spamjadoo engineering.