What is DMARC?
Also known as: Domain-based Message Authentication, Reporting and Conformance
DMARC is an email authentication policy protocol that builds on SPF and DKIM to tell receiving mail servers how to handle messages that fail authentication checks.
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is an email validation system designed to give domain owners control over what happens to emails that fail SPF or DKIM checks. DMARC is defined in RFC 7489, published in March 2015. It operates as a policy layer on top of SPF and DKIM, allowing a domain owner to publish a policy in their DNS records that instructs receiving mail servers on how to treat unauthenticated email.
When a receiving mail server gets a message claiming to be from a domain, it first checks the domain's DMARC DNS record. That record contains a policy directive: none (take no action, just report), quarantine (mark as spam), or reject (block the message). The server then verifies that the message passes either SPF alignment (the envelope domain matches the header From domain) or DKIM alignment (the signing domain matches the header From domain). If neither check passes, the server applies the published policy. DMARC also includes a reporting mechanism: receiving servers can send aggregate and forensic reports back to the domain owner, giving them visibility into who is sending email on their behalf.
DMARC sits above SPF and DKIM in the email security stack. SPF handles envelope-level authentication, DKIM handles cryptographic signing, and DMARC ties them together with a policy and reporting framework. It is widely used by brands, financial institutions, and government agencies to prevent direct domain spoofing and phishing attacks. Adoption requires careful monitoring during the policy transition from none to quarantine to reject, because misconfiguration can cause legitimate email to be blocked.
Key facts
- DMARC is defined in RFC 7489, published March 2015.
- It allows domain owners to set a policy of none, quarantine, or reject for failing messages.
- DMARC requires alignment of the header From domain with either SPF or DKIM.
- Aggregate reports (RUA) and forensic reports (RUF) give domain owners visibility into email sources.
- DMARC does not authenticate email itself; it relies on SPF and DKIM for authentication.
- A DMARC record is a TXT record published at _dmarc.example.com in DNS.
How it works in practice
Related terms
References
More in Email
BIMI
BIMI (Brand Indicators for Message Identification) is a DMARC-aligned standard that lets email senders publish a verified logo for display in supporting mail clients.
Bounce Message
A bounce message, or non-delivery report (NDR), is an automated email sent to the originator when delivery cannot be completed, including a status code and failure reason.
Catch-All Email
A catch-all email account receives all messages sent to invalid or nonexistent addresses at a domain, preventing bounce-backs but attracting spam.
DKIM
DKIM is an email authentication method that lets a domain claim responsibility for a message by attaching a cryptographic signature validated against a DNS public key.
DNSBL
A DNSBL is a real-time IP reputation database published via DNS, used by mail servers at SMTP time to reject or flag senders known for spam or abuse.
Greylisting
Greylisting is a spam-filtering technique that temporarily rejects email from unknown senders, forcing legitimate mail servers to retry delivery while filtering out spammers that do not retry.
IMAP
IMAP is an email protocol that lets clients access and manage messages stored on a mail server, keeping the server as the authoritative copy and synchronizing folder state across multiple devices.
Mailbox Quota
A mailbox quota is a storage limit placed on a user's email account. Once the total size of stored messages exceeds this limit, the server may reject new incoming emails or warn the user.
MDA
An MDA (Mail Delivery Agent) is a software component that transfers an email from a Mail Transfer Agent (MTA) into a recipient's local mailbox, typically on a mail server or a user's machine.
MTA
An MTA (Mail Transfer Agent) is server software that routes email between domains using the SMTP protocol, acting as the core delivery engine for internet email.