What Is DMARC?

SPF and DKIM each produce a pass or a fail, but neither says what a receiver should do about it, and neither checks the From address the reader actually sees. DMARC supplies both halves: a policy for failures, and the alignment rule that ties a passing check to the visible From domain.

Alignment is the part that stops spoofing. A message can pass SPF for a domain the sender controls while showing your brand in the From address; under DMARC that message fails, because the domain that passed is not the domain on display.

The policy tag sets the instruction. p=none asks receivers to do nothing differently and just send reports, p=quarantine asks them to treat failing mail as suspicious, usually meaning spam placement, and p=reject asks them to refuse it outright.

The normal path is to start at p=none, read the reports until every legitimate sending source is authenticated, then move to quarantine and finally to reject. Starting at reject before the reports are clean blocks your own mail.

Only v=DMARC1 and p= are required. The rua tag names where aggregate reports should be sent, adkim and aspf set how strictly each underlying check has to align with the From domain, and pct applies the policy to a sample of failing mail rather than all of it.

The pct tag is the rollout control most senders never use. Publishing p=quarantine with pct=10 asks receivers to quarantine roughly one failing message in ten, which surfaces breakage at a survivable scale before the policy covers everything. It has no effect at p=none, because there is no action to sample.

Subdomains inherit the policy of the organisational domain, so p=reject on a domain already covers a subdomain that publishes no record of its own. The sp tag overrides that inheritance, which is how a domain runs a strict policy on its main mail while a subdomain is still being brought up to enforcement.

The np tag narrows it further, to subdomains that do not exist at all. A name with no MX and no address record is attractive to spoof precisely because nobody is watching it, and np=reject closes that off without changing how the subdomains you do use are treated.

Google and Yahoo both require an authenticated setup with a DMARC record for bulk senders to their consumer domains, a change both announced in 2024. For any sender at volume it is a practical requirement rather than a best practice.

A minimal record is enough to satisfy it. What matters more is that the reports get read, because the report stream is the only place a misconfigured sending tool or an unauthorised sender shows up before recipients notice.