Anyone can put your domain in the From line
Email has no built-in check on the From address. Anyone can send a message that says it comes from invoices@example.com, and the reader sees the same address as on your own mail.
Fake invoices and phishing messages rely on this. They borrow a domain the reader already trusts.
Two older checks help, but neither closes the gap. SPF says which servers may send mail for a domain. DKIM lets a domain sign its messages. Both can pass for a domain other than the one in the From line, so a pass on its own says nothing about you.
What DMARC adds
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two checks to the domain people see. A message passes DMARC when SPF or DKIM passes for the domain in its From address. This match is called alignment.
The guide SPF, DKIM and DMARC together shows which address each check reads.
DMARC also lets you say what should happen to mail that fails, and asks mailbox providers to send you reports on the mail they received with your domain in the From address.
What a DMARC record looks like
DMARC is one TXT record in your domain's DNS, under the name _dmarc. For example.com, the record sits at _dmarc.example.com and can read:
v=DMARC1; p=none; rua=mailto:k7m2qz4hx6tpr3wn5yjd @rep.mailmoni.com
v=DMARC1- Says that this is a DMARC record. It comes first.
p=none- The policy: what you ask mailbox providers to do with mail that fails. The value is none, quarantine or reject.
rua=mailto:- The address that receives the reports.
A domain has exactly one DMARC record. If it has two, mailbox providers ignore both.
The policy covers your subdomains too, unless the record sets a separate policy for them with sp=.
What happens to mail that fails
The policy is a request to the mailbox provider that receives the message:
- p=none: deliver the mail as if there were no DMARC record, and report.
- p=quarantine: treat the mail as suspicious, which usually means the spam folder.
- p=reject: refuse the mail.
Each mailbox provider makes the final decision under its own rules. Start at p=none and move up in steps. The DMARC policy, step by step explains when.
The reports are the useful part at first
Mailbox providers that support DMARC send a report to the address in rua, usually once a day each.
This aggregate report lists the servers that sent mail with your domain in the From address, how many messages each one sent, and whether SPF, DKIM and DMARC passed. It holds counts and results, not the messages themselves.
Read together, the reports show every service that sends as you: your own mailbox provider, a newsletter tool, an invoicing system, a web shop or a printer that emails scans. They also show servers that have nothing to do with you.
If you move to a stricter policy before each of your own services passes, their mail goes to spam or is refused along with the fakes. So you read the reports first, fix each service, and then move.
The reports arrive as XML files, usually compressed, attached to email. They are written for software to read, not people.
What DMARC does not do
- It protects your exact domain. It does not stop look-alike domains, such as example-invoices.com, or a display name that copies your company's name over another address.
- It does not decide whether a message is spam. A message can pass DMARC and still go to spam because of its content or its sender's reputation.
- It covers mail sent with your domain in the From address. It says nothing about mail sent to you.