DMARC Implementation Guide

DMARC (Domain-based Message Authentication, Reporting & Conformance, RFC 7489) is the policy layer that sits on top of SPF and DKIM. SPF and DKIM each produce a pass/fail result, but neither tells a receiver what to do with a failure, and neither protects the From: address that recipients actually see. DMARC closes both gaps:

1. Alignment — it requires that a passing SPF or DKIM result be tied to the same domain shown in the From: header, defeating the spoofing that SPF and DKIM alone allow. 2. Policy — it tells receivers whether to monitor, quarantine, or reject mail that fails DMARC. 3. Reporting — it instructs receivers to send you aggregate (and optionally forensic) reports, giving you visibility into every source sending as your domain.

Since February 2024, Google and Yahoo require a DMARC record for bulk senders (5,000+ messages/day), making DMARC effectively mandatory for any serious sender.

DMARC's core mechanism is identifier alignment. A message passes DMARC only if at least one of the following is true:

• SPF alignment — SPF passes AND the envelope MAIL FROM domain matches the From: header domain. • DKIM alignment — a DKIM signature passes AND its d= domain matches the From: header domain.

Either path is sufficient; you do not need both. Alignment can be relaxed (default) — where a subdomain like mail.yourdomain.com aligns with the organizational domain yourdomain.com — or strict, where the domains must match exactly. This is why a message can pass raw SPF yet fail DMARC: if SPF authenticated bounce.sendgrid.net while the From: shows yourdomain.com, SPF passes but does not align.

DMARC is a single TXT record published at the _dmarc subdomain. A minimal monitoring record looks like this:

A DMARC record is a list of tag=value pairs. v and p are required; the rest are optional but rua is strongly recommended:

The policy tag p= decides what receivers do with mail that fails DMARC:

• p=none — monitor only; take no action. The mandatory starting point. • p=quarantine — deliver failing mail to spam/junk. • p=reject — refuse failing mail at the SMTP layer. The end goal.

Two tags control rollout and scope: • pct= applies the policy to only a percentage of failing mail (e.g. pct=25), letting you ramp quarantine/reject gradually rather than all at once. • sp= sets a separate policy for subdomains. Attackers frequently spoof unused subdomains; if you do not send from subdomains, set sp=reject explicitly so they inherit strong protection regardless of p=.

Move toward enforcement in stages, driven by what the reports show — never jump straight to reject:

1. Monitor. Publish p=none with reporting and collect data for 2–4 weeks:

2. Fix sources. From the aggregate reports, identify every legitimate sender failing alignment and correct their SPF/DKIM (custom DKIM signing for ESPs, missing includes for SPF).

3. Quarantine a slice. Once legitimate mail aligns, move to quarantine at a low percentage and watch for fallout:

4. Ramp to 100%. Increase pct to 100 once quarantine causes no legitimate-mail problems.

5. Reject. Move to full enforcement, optionally with strict alignment and an explicit subdomain policy:

Aggregate reports (rua) are gzipped XML files most receivers send once per day. Each report lists, per sending source: • the source IP and the volume of messages it sent as your domain, • the SPF result and whether it aligned, • the DKIM result and whether it aligned, • the DMARC disposition that was applied (none/quarantine/reject).

Use these to build an inventory of every legitimate sender before you enforce, and to spot spoofing attempts. The XML is dense; tools like Postmark's free DMARC service, dmarcian, or Valimail aggregate and visualize it, though you can parse it yourself. Forensic reports (ruf) contain redacted copies of individual failing messages but are honored by very few receivers today.

Confirm your record is present, syntactically valid, and shows the policy and alignment you intend with our free DMARC Checker, and build or refine the record with the DMARC Record Generator.

Once DMARC is at p=quarantine or p=reject with full alignment, you have met the prerequisite for BIMI — displaying your verified brand logo in the inbox.