Definition
DMARC evaluates the domain in the visible RFC 5322 From header against authenticated SPF and DKIM identities. The message passes when at least one mechanism passes and its domain aligns with the author domain.
A published DMARC record can request monitoring, quarantine, or rejection for failures and can direct aggregate reports to the domain owner. In 2026, RFC 9989 replaced RFC 7489; aggregate and failure reporting are specified separately in RFC 9990 and RFC 9991.
Why it matters
DMARC makes direct spoofing of an exact domain harder and gives owners visibility into systems sending as their domain. It does not stop lookalike domains, display-name deception, compromised authorized accounts, or every form of phishing.
How it works
- 01
The receiver extracts the visible From domain.
- 02
SPF and DKIM are evaluated normally.
- 03
The receiver checks whether a passing authenticated domain aligns with From.
- 04
For failures, the receiver considers the discovered DMARC policy alongside local filtering rules and produces reporting data.
Example
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
v=DMARC1 protocol version
p=none monitoring policy
rua=... aggregate report destinationCommon mistakes
- Moving to rejection before identifying every legitimate sender.
- Assuming SPF and DKIM passes count when neither domain aligns with From.
- Publishing more than one DMARC record.
- Following older rollout advice built around the removed pct tag.
Key takeaways
- One aligned SPF or DKIM pass produces a DMARC pass.
- Use reporting to inventory senders before enforcement.
- Treat DMARC as exact-domain protection, not a complete phishing defense.