Authentication

DMARC

A DNS policy that tells receiving servers what to do with mail that fails SPF/DKIM alignment (none, quarantine, or reject), and provides aggregate reports on who’s sending as your domain.

What DMARC adds

SPF and DKIM each verify a domain, but not necessarily the domain in the From address a reader sees. DMARC closes that gap: a message passes only if SPF or DKIM passes and the verified domain aligns with the visible From domain.

The policy is a TXT record at _dmarc.yourdomain.com, such as v=DMARC1; p=quarantine; rua=mailto:[email protected].

The three policies

p=none: monitor only. Nothing changes for failing mail, but you receive reports. This is where everyone should start.
p=quarantine: failing mail goes to spam.
p=reject: failing mail is refused outright. This is the strongest protection against spoofing.

Rolling DMARC out safely

Start at p=none with a reporting address, and read the aggregate reports for a few weeks. They show every service sending as your domain, including ones you forgot about, like a billing tool or help desk.

Once every legitimate source passes, move to quarantine, optionally with pct= to apply it to only a share of mail at first, and then to reject. Gmail and Yahoo now require at least a p=none DMARC record for bulk senders.

DMARC and MailCraft

Because MailCraft signs with your own domain’s DKIM key, mail sent through us aligns for DMARC. Our free DKIM/DMARC checker reads your current policy and tells you whether it’s monitoring or enforcing.

Let MailCraft handle the details

Authentication, bounces, complaints and suppression are built in. Start free with 3,000 emails a month, no credit card required.

Start free

Related terms

Full glossary