{"id":74075,"date":"2023-09-04T18:14:23","date_gmt":"2023-09-04T18:14:23","guid":{"rendered":"https:\/\/mailrelay.com\/glosario\/dmarc\/"},"modified":"2026-10-04T05:04:39","modified_gmt":"2026-10-04T05:04:39","slug":"dmarc","status":"publish","type":"glossary","link":"https:\/\/mailrelay.com\/en\/glossary\/dmarc\/","title":{"rendered":"DMARC"},"content":{"rendered":"\n

DMARC is a protocol that tells Gmail, Outlook or Yahoo what to do with an email that claims to come from your domain but fails authentication.<\/strong> They can deliver it anyway, send it to spam or reject it.<\/p>\n\n

It also sends you reports listing every server that uses your domain. That way you find out if someone is spoofing it.<\/p>\n\n

Think of a building’s doorman. SPF and DKIM are the credentials you show; DMARC is the order you’ve given the doorman about what to do with anyone who doesn’t have them.<\/p>\n\n

What is DMARC?<\/h2>\n\n

It stands for Domain-based Message Authentication, Reporting and Conformance. It was published as RFC 7489 in 2015, following the work of a group of companies that included Google, Microsoft, Yahoo and PayPal.<\/p>\n\n

It doesn’t replace SPF or DKIM: it builds on them.<\/strong> SPF<\/a> checks which servers can send on behalf of your domain. DKIM<\/a> signs each message to prove it hasn’t been modified.<\/p>\n\n

DMARC adds two things they were missing: a policy for emails that fail and a reporting system.<\/p>\n\n

How does DMARC work?<\/h2>\n\n

Every time an email arrives, the recipient’s server follows these steps.<\/p>\n\n

\"How<\/figure>\n\n

1. It reads the sender’s domain<\/h3>\n\n

It looks at the domain in the From field, the one the person receiving the email sees.<\/p>\n\n

2. It checks SPF and DKIM<\/h3>\n\n

It verifies whether the sending server is authorized by SPF and whether the DKIM signature is valid.<\/p>\n\n

3. It checks alignment<\/h3>\n\n

This is the step that makes this standard unique.<\/strong> It’s not enough for SPF or DKIM to return “pass”: the domain they authenticate has to match the one in the From field.<\/p>\n\n

If at least one of the two passes and is aligned, the message passes DMARC.<\/p>\n\n

4. It applies your policy and records the result<\/h3>\n\n

If the message fails, the receiver applies the policy you’ve published. It then includes the result in the report it sends you.<\/p>\n\n

The three DMARC policies<\/h2>\n\n

The policy is set with the p= tag and has three possible values:<\/p>\n\n

Policy<\/th>What happens to emails that fail<\/th>When to use it<\/th><\/tr><\/thead>
p=none<\/td>They’re delivered as usual; you only receive reports<\/td>When starting out, to see who is sending with your domain<\/td><\/tr>
p=quarantine<\/td>They go to the spam folder<\/td>Once you’ve reviewed the reports and your legitimate emails pass<\/td><\/tr>
p=reject<\/td>They’re rejected and never arrive<\/td>When you have everything under control and want maximum protection<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The best approach is to move forward gradually:<\/strong> start with none, review the reports for a few weeks, then move up to quarantine and finally to reject.<\/p>\n\n

What a DMARC record contains<\/h2>\n\n

The record is a TXT record published at _dmarc.yourdomain.com<\/strong>. A complete example:<\/p>\n\n

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; pct=100<\/p>\n\n

These are the most common tags:<\/p>\n\n

Tag<\/th>What it indicates<\/th>Example<\/th><\/tr><\/thead>
v<\/td>Protocol version (required)<\/td>v=DMARC1<\/td><\/tr>
p<\/td>Policy for your domain (required)<\/td>p=none<\/td><\/tr>
rua<\/td>Address that receives the aggregate reports<\/td>rua=mailto:reports@yourdomain.com<\/td><\/tr>
pct<\/td>Percentage of emails the policy applies to<\/td>pct=50<\/td><\/tr>
sp<\/td>Policy for subdomains<\/td>sp=reject<\/td><\/tr>
adkim \/ aspf<\/td>Strict alignment (s) or relaxed (r)<\/td>adkim=r<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

There can only be one record of this type per domain<\/strong>. If you publish two, receivers ignore them.<\/p>\n\n

Why is this so important?<\/h2>\n\n

Because the major providers already require it.<\/strong> Since February 2024, Gmail and Yahoo have required a DMARC record, even if it’s just p=none, from anyone sending more than 5,000 emails a day. Microsoft has applied similar requirements in Outlook since May 2025.<\/p>\n\n

It also protects your brand from phishing. With p=reject, a fake email using your domain doesn’t reach the inbox.<\/p>\n\n

And it improves your deliverability<\/a>. A domain with SPF, DKIM and DMARC properly configured builds trust with email providers.<\/p>\n\n

Finally, it’s a requirement for BIMI<\/a>, which displays your brand’s logo next to your emails. For that you need a quarantine or reject policy.<\/p>\n\n

\n

Protect your domain and reach the inbox<\/strong><\/p>\n\n\n\n

Set up SPF, DKIM and DMARC in Mailrelay and send up to 80,000 emails a month for free to 20,000 contacts.<\/p>\n\n\n\n

\n
Create a free account<\/a><\/div>\n<\/div>\n<\/div><\/div>\n\n

How to set up DMARC step by step<\/h2>\n\n

Before you start, make sure SPF and DKIM are already working. Without them, all your emails would fail the check.<\/p>\n\n

1. Create the record with p=none<\/h3>\n\n

Go to your domain’s DNS and add a TXT record named _dmarc<\/strong> with a value such as v=DMARC1; p=none; rua=mailto:reports@yourdomain.com.<\/p>\n\n

2. Review the reports<\/h3>\n\n

Receivers will send you a daily XML report listing the servers that have used your domain and their results. There are free tools that turn them into easy-to-read tables.<\/p>\n\n

3. Fix the emails that fail<\/h3>\n\n

If a legitimate tool, such as your CRM or your online store, shows up with failures, add it to your SPF or set up its DKIM signature with your domain.<\/p>\n\n

4. Tighten the policy<\/h3>\n\n

When all your legitimate emails pass, switch to p=quarantine. You can use pct=25 to apply it to part of your traffic first. Then move to p=reject.<\/p>\n\n

Common mistakes when setting it up<\/h2>\n\n

The most common one is staying on p=none forever.<\/strong> It meets the Gmail and Yahoo requirement, but it doesn’t stop anyone spoofing your domain.<\/p>\n\n

Other common mistakes:<\/p>\n\n