What is DMARC?
DMARC is the policy layer on top of SPF and DKIM. It requires that one of them passes AND belongs to the domain in the visible From: address, then tells receivers what to do when neither does: nothing, quarantine, or reject. It is the only one of the three that carries an instruction.
Written by the SieveGuard team from the checks our own free tools run. Last reviewed .
The record, tag by tag
_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com; sp=reject; adkim=s"
| Tag | Does | Default if omitted |
|---|---|---|
| v=DMARC1 | Version. Must be first | Required |
| p= | Policy: none, quarantine or reject | Required |
| pct= | Percentage of failing mail the policy applies to | 100 |
| rua= | Where to send aggregate reports | None — and without it you are blind |
| ruf= | Where to send per-message forensic reports | None. Rarely honoured now |
| sp= | Policy for subdomains | Inherits p= |
| adkim= | DKIM alignment: r (relaxed) or s (strict) | r |
| aspf= | SPF alignment: r or s | r |
| fo= | When to generate forensic reports | 0 |
Two defaults worth knowing. sp= inherits, so publishing p=reject silently applies reject to every subdomain including ones you forgot about. And ruf= is largely dead — most large receivers stopped sending forensic reports on privacy grounds, so aggregate reports are the ones that matter.
What each policy actually does
| Policy | Receiver behaviour | Protects you? | Use when |
|---|---|---|---|
| p=none | Nothing. Deliver as normal, send reports | No | Weeks 1–6, while you read reports |
| p=quarantine | Route failing mail to spam | Partly | Once reports are clean, as a ramp step |
| p=reject | Refuse at SMTP time — the message never lands | Yes | The destination |
p=none is where most domains stop, and it is worth being blunt about what that means: it is monitoring, not protection. A domain on p=none can be spoofed as freely as one with no DMARC record at all. The only thing it buys is visibility — which is genuinely valuable, and is not the same as safety.
The ramp, with realistic timings
The point of ramping is to find your own forgotten senders before enforcement finds them for you. Every organisation has some: the invoicing system, the CRM, the monitoring alerts, the thing a departed colleague set up in 2021.
| Stage | Record | Stay here until |
|---|---|---|
| 1. Observe | p=none; rua=… | Reports account for 100% of legitimate volume — 2 to 6 weeks |
| 2. Fix | p=none; rua=… | Every legitimate source authenticates and aligns |
| 3. Toe in | p=quarantine; pct=10 | One to two weeks, watching for complaints |
| 4. Ramp | p=quarantine; pct=50 → 100 | Two to four weeks total |
| 5. Enforce | p=reject | Permanent. Keep reading reports |
How pct actually works is misread constantly. It is not "apply the policy to 10% of mail". It is: for each failing message, with probability pct, apply the policy — otherwise apply the next weaker one. So p=quarantine; pct=10 quarantines roughly a tenth of failures and delivers the rest normally. Under p=reject; pct=10, the other 90% are quarantined, not delivered.
Reading aggregate reports
They arrive as gzipped XML, once a day per reporting receiver, and they are not designed to be read by humans. Each record is a group of messages sharing a source IP and result:
<record>
<row>
<source_ip>203.0.113.7</source_ip>
<count>142</count>
<policy_evaluated><disposition>none</disposition>
<dkim>pass</dkim><spf>fail</spf></policy_evaluated>
</row>
<identifiers><header_from>yourdomain.com</header_from></identifiers>
</record>What to look for, in order: sources with high count and both results failing (either spoofing or a forgotten sender of yours), then sources where spf passes but the disposition still fails — that is an alignment problem, not an authentication one, and it is the most common thing these reports surface.
Send rua to an address you will actually process. A mailbox nobody opens is the usual reason a domain sits on p=none for two years.
Mistakes that cost real mail
Publishing p=reject on day one
The reports exist precisely because you do not know all your senders. Enforcing before reading them means discovering the invoicing system by way of unpaid invoices.
Forgetting sp= on parked domains
sp= inherits p=, which is usually what you want — but a domain you do not send from at all should carry p=reject; sp=reject from the start. There is no ramp needed for mail that never legitimately exists.
Two DMARC records
Same rule as SPF: exactly one. Two records at _dmarc means receivers apply no policy at all, which looks identical to having none.
Treating a clean report as done
Reports show what receivers saw during that window. A quiet week does not mean a new sender was not added on Monday. This is monitoring, not a certificate.
Sources
FAQ
What does p=none actually protect against?+
Nothing. It is monitor-only: mail is delivered exactly as it would be without any DMARC record, and reports are sent. A domain on p=none can be spoofed as freely as one with no record. What it buys is visibility, which is the necessary first step and not protection.
What is the difference between quarantine and reject?+
Quarantine asks receivers to treat failing mail as suspicious, which in practice means the spam folder. Reject refuses the message at SMTP time so it is never delivered at all and the sender gets a bounce. Reject is the end state; quarantine is the ramp toward it.
How does the pct tag work?+
For each failing message, with probability pct the policy is applied; otherwise the next weaker policy is. So p=quarantine with pct=10 quarantines about a tenth of failures and delivers the rest, and p=reject with pct=10 rejects a tenth and quarantines the other ninety percent.
How long should I stay on p=none?+
Until aggregate reports account for essentially all of your legitimate volume and every source authenticates and aligns. Two to six weeks is typical. Sitting there for a year usually means the rua address is a mailbox nobody opens.
Do I need DMARC if I already have SPF and DKIM?+
Yes, for two reasons. SPF and DKIM check domains that a reader never sees, so without DMARC nothing ties authentication to the visible From: address. And neither carries an instruction — DMARC is the only record that tells a receiver to refuse.
What about domains I never send mail from?+
Publish v=DMARC1; p=reject; sp=reject straight away, alongside an SPF record of v=spf1 -all. There is no legitimate mail to break, so there is no ramp to run, and parked domains are attractive spoofing targets precisely because they are unwatched.
Check it on a real domain
Free, no signup, DNS-only. Nothing you type leaves the lookup.