What Is DMARC? How It Works, Policies & Configuration Tips

Blog, DMARC

Understand what DMARC is, how it prevents spoofing, and how to publish your own record. See examples and learn how to avoid setup errors.

by Maitham Al Lawati

Reading Time: 10 min
What Is DMARC? How It Works, Policies & Configuration Tips
Table Of Contents−

Key Takeaways

  • DMARC helps protect your domain from phishing, spoofing, and AI-generated email attacks by verifying whether emails truly come from your domain.
  • Combining SPF, DKIM, and DMARC creates a strong authentication framework that improves security and boosts inbox deliverability.
  • Mistakes like misconfigured policies, ignoring reports, poor SPF/DKIM alignment, or moving to “reject” too quickly can weaken your protection.

In 2025, roughly 376 billion emails are sent each day worldwide, making email one of the most used communication channels. Unfortunately, this popularity also attracts cybercriminals: AI-powered phishing attacks are on the rise, with reports showing around 1.96 million phishing attacks in a single year, representing roughly a 182% increase compared with 2021 levels.

To protect your email communications and your brand’s reputation, you need to learn what DMARC is and why it matters. DMARC helps verify that your messages are legitimate, prevents attackers from impersonating your domain, and improves your chances of reaching the inbox. It’s now widely used across finance, healthcare, manufacturing, technology, and other industries where secure communication is essential.

What is DMARC?

DMARC is an email authentication protocol designed to stop email fraud and phishing. It gives domain owners control over how their email should be authenticated and what should happen if a message fails those checks.

DMARC verifies whether an email truly comes from your domain and provides reports that show who is sending on your behalf. This helps organizations strengthen security and protect their domain reputation. Many businesses also use DMARC providers to manage setup, reporting, and policy enforcement.

DMARC works alongside SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to ensure that only authorized senders can use your domain. It doesn’t replace antivirus or firewalls, but it adds an essential layer of protection. With DMARC, organizations can choose what happens to unauthenticated emails (whether they’re rejected, quarantined, or delivered).

What does DMARC stand for?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance.

Understanding what each part of the DMARC acronym means helps you see how the protocol protects your domain, improves deliverability, and gives you visibility into who is sending mail on your behalf. Each component reflects a function you need to understand in order to configure DMARC correctly and interpret your reports.

  • Domain-based: DMARC works at the domain level. You publish a DNS policy that tells receiving servers how to treat mail claiming to come from your domain.
  • Message authentication: DMARC checks whether your emails pass SPF or DKIM, and whether the domain they verify matches the one in the “From” header. This alignment helps block spoofed messages.
  • Reporting: DMARC can send you reports that show who is using your domain and how your emails are performing. These include aggregate summaries and, when enabled, forensic details on failures.
  • Conformance: You set a policy (none, quarantine, or reject) telling receivers what to do with emails that fail DMARC checks. This determines how strictly your domain is protected.

How DMARC Protects Your Emails

DMARC enhances email security by adding a layer of policy enforcement and reporting on top of existing authentication methods: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). A sender domain publishes a DMARC report in DNS specifying its policy. When an email is sent claiming to be from that domain:

  1. Email sending and initial checks: The sending server typically applies DKIM signatures. The email undergoes standard transit.
  2. Email reception and authentication: The receiving server performs the following checks:
    • SPF check: Verifies if the sending IP address is listed in the domain’s SPF record.
    • DKIM check: Validates the email’s digital signature using the public key in the domain’s DNS to ensure it hasn’t been tampered with.
    • Alignment check: Confirms that the domain in the “From” header matches the domain validated by SPF or DKIM. This prevents spoofed domains from passing authentication.
  3. DMARC policy enforcement: The receiving server checks the sender domain’s DMARC record in DNS.
    • If the email passes SPF or DKIM checks and achieves alignment for at least one of them, it passes DMARC and is typically delivered normally.
    • If the email fails both SPF and DKIM, or fails alignment for both, the receiving server applies the DMAR
    • C policy specified in the sender’s DMARC record (e.g., p=none for monitoring, p=quarantine to send to spam, or p=reject to block the email).
  4. Reporting: The receiving server generates aggregate (RUA) reports summarizing authentication data (pass/fail counts, IPs, alignment results) and potentially forensic (RUF) reports detailing individual failures. These reports are sent to the addresses specified in the sender domain’s DMARC record.

Many organizations choose to simplify and automate this entire process using solutions like PowerDMARC. For example, UK-based Managed Service Provider PrimaryTech partnered with PowerDMARC to streamline the management of SPF, DKIM, and DMARC records across multiple client domains. 

This not only helped them ensure accurate DNS record configuration and policy enforcement but also enhanced their clients’ email deliverability and protection against spoofing attacks, demonstrating the real-world impact of effective DMARC implementation.

Why DMARC Is Essential for Email Security

DMARC strengthens email security by addressing some of the biggest risks organizations face today:

  • Preventing email spoofing and phishing: DMARC verifies that emails truly come from your domain, blocking attackers who try to impersonate you. This is especially important as phishing attacks grow more convincing and more frequent.
  • Improving email deliverability: Authenticated emails are more likely to reach the inbox (rather than the spam folder). DMARC helps legitimate messages pass filters consistently and improves overall deliverability.
  • Protecting your brand reputation: When attackers misuse your domain for phishing or spam, customers lose trust. DMARC prevents unauthorized use of your domain and protects your brand from being associated with fraud.
  • Providing actionable insights: DMARC reports show who is sending mail using your domain, which messages are failing authentication, and where configuration problems may exist. This visibility helps you detect unauthorized senders and fix issues quickly.
  • Meeting industry compliance requirements: DMARC adoption is increasingly tied to compliance expectations across several sectors, such as finance (PCI-DSS), healthcare (HIPAA guidance), and even tech platforms like Google and Yahoo, which now enforce stricter requirements for unauthenticated email.

Implementing DMARC gives organizations stronger security, a more trusted domain, and better inbox placement for their legitimate communications.

Simplify DMARC with PowerDMARC!

Start 15-day trial Book a demo

How to Configure DMARC?

Configuring DMARC is essential because it tells receiving mail servers how to handle emails sent from your domain. Without a proper configuration, even legitimate messages can fail authentication, and attackers can more easily impersonate your domain.

Here are the steps you need to follow:

1. Configure SPF and DKIM

Before implementing DMARC, ensure SPF and DKIM are properly configured for your domain and all legitimate sending sources:

  • SPF: Defines which IP addresses and servers are authorized to send emails on behalf of your domain.
  • DKIM: Adds a digital signature to your emails, verifying the sender and ensuring the message hasn’t been tampered with during transit.

These protocols form the foundation for DMARC. DMARC requires at least one of SPF or DKIM to pass and align, though implementing both is strongly recommended for enhanced security. Ensure you identify *all* legitimate email sources (including third-party services like marketing platforms or CRMs) and authorize them via SPF/DKIM.

2. Create a DMARC Record

A DMARC record is a TXT (Text) record published in your domain’s DNS (Domain Name System) settings. It specifies your email authentication policy. It includes:

  • Mandatory tags:
    • v=DMARC1: Indicates the DMARC version (currently always DMARC1).
    • p=none/quarantine/reject: Defines the policy for handling emails that fail DMARC authentication and alignment checks.
  • Optional but recommended tags:
    • rua=mailto:[email protected]: Where aggregate reports are sent.
    • ruf=mailto:[email protected]: Where forensic failure reports are sent.
    • pct=100: Percentage of messages the policy applies to.
    • sp=none/quarantine/reject:  Policy for subdomains.
    • adkim=r/s:  DKIM alignment mode (relaxed or strict).
    • aspf=r/s: SPF alignment mode (relaxed or strict).

You can use online tools to help generate your DMARC record syntax correctly.

3. Select a DMARC Policy

DMARC policies tell email receivers how to handle messages that fail authentication or alignment checks. There are three types of DMARC policies, each offering a different level of enforcement:

  • p=none (Monitoring Mode): No action is taken on failing emails; reports are sent so you can understand your sending sources.
  • p=quarantine: Failing emails are treated as suspicious and are usually placed in the spam folder.
  • p=reject: Failing emails are blocked entirely, providing the strongest protection.

4. Publish Your DMARC Record

Once your DMARC record is created, publish it in your DNS settings as a TXT record:

  • Host/Name field: Enter _dmarc (e.g., _dmarc.yourdomain.com).
  • Record type: Select TXT.
  • Value/Data field: Paste your DMARC record string (e.g., “v=DMARC1; p=none; rua=mailto:[email protected];”).
  • TTL (Time to Live): Typically set to 1 hour (3600 seconds) or your DNS provider’s default.

This makes your DMARC policy accessible to email receivers worldwide.

5. Verify Your DMARC Setup

After publishing your record, you should verify that everything is configured correctly. Tools like Google Admin Toolbox can confirm whether your DMARC, SPF, and DKIM records are visible and valid.

For deeper validation, PowerDMARC’s DMARC checker provides a full analysis of your DNS record, highlights syntax errors, and shows whether your policy is correctly enforced across mail providers. This ensures your setup is accurate, secure, and ready for monitoring.

6. Enable and Monitor Reporting

Ensure your DMARC record includes the `rua` tag pointing to a dedicated mailbox to receive aggregate reports. These reports, typically sent daily in XML format, are crucial for monitoring:

  • Aggregate reports (rua): Provide an overview of email authentication results from various receivers, including IP addresses sending mail claiming to be from your domain, SPF/DKIM pass/fail counts, and alignment status. Analyzing these reports (often with a DMARC analyzer service) helps identify legitimate sending sources needing configuration adjustments and spot unauthorized use.
  • Forensic reports (ruf): Offer detailed information (including headers and sometimes content snippets) about specific individual email delivery failures. Due to volume and privacy concerns, not all receivers send RUF reports, and processing them requires careful handling.

Regularly review reports, especially after starting with `p=none`, to fix SPF/DKIM/alignment issues for legitimate senders before moving to `p=quarantine` or `p=reject`. Keep DNS records accurate and up-to-date as sending sources change.

What Does DMARC Record Look Like?

The structure of a DMARC record is defined in the DNS (Domain Name System) as a TXT record associated with the domain, specifically at the `_dmarc` subdomain. It contains several tag-value pairs separated by semicolons, including ones that specify the policy mode and reporting options. Here’s an example of what a DMARC record might look like:

_dmarc.example.com. IN TXT “v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; pct=100; adkim=r; aspf=r;”

In this example:

  • “_dmarc.example.com.” specifies the DNS hostname for the DMARC record of “example.com.”
  • “IN TXT” indicates the record type as a text record.
  • “v=DMARC1” signifies the DMARC protocol version being used is version 1. This tag is mandatory.
  • “p=reject” sets the DMARC policy for the main domain to “reject”. This instructs receiving email servers to reject emails that fail DMARC checks for example.com. This tag is mandatory.
  • “rua=mailto:[email protected]” specifies the email address as the destination to receive aggregate reports (summaries of authentication results). This tag is highly recommended for monitoring.
  • “ruf=mailto:[email protected]” designates the email address as the destination to receive forensic reports (details on individual failures). This tag is optional.
  • “sp=reject” sets the subdomain policy to “reject,” ensuring that this DMARC policy also applies strictly to subdomains (e.g., mail.example.com), unless they have their own DMARC record. This tag is optional.
  • “pct=100” indicates that the policy (reject in this case) should apply to 100% of emails failing DMARC checks. Optional; defaults to 100.
  • “adkim=r” sets DKIM alignment requirement to relaxed (subdomain matches allowed). Optional; defaults to relaxed (r).
  • “aspf=r” sets SPF alignment requirement to relaxed (subdomain matches allowed). Optional; defaults to relaxed (r).

Common DMARC Mistakes and How to Avoid Them

Implementing and managing DMARC can be complex, and even experienced administrators run into common pitfalls. This practical guide highlights real-world issues that can make or break the effectiveness of your DMARC setup.

Understanding these mistakes and how to avoid them will help you get the most out of DMARC and keep your email domain secure.

Misconfiguring your policy is one of the most frequent errors is misconfiguring the DMARC policy in your DNS record. This could mean using incorrect syntax, unsupported tags, or missing required tags like v= (which specifies the DMARC version) and p= (which sets the policy action, such as none, quarantine, or reject). 

Incorrect or missing policy tags can cause serious issues, from emails not being properly enforced to legitimate messages failing to deliver. Ensuring your policy syntax is correct and only includes supported tags is essential for DMARC to work as intended.

Setting up DMARC is common, but not monitoring reports is where many organizations go wrong. Enabling and regularly reviewing DMARC aggregate (rua) and forensic (ruf) reports is key to understanding how your domain is being used or abused. Ignoring these reports means missing out on valuable insights about failing authentication attempts, unauthorized senders, and misaligned sources.

Since DMARC reports come in XML format, their complexity often leads to neglect. Using user-friendly tools and dashboards like Postmark, DMARCian, or similar services can turn this data into actionable insights that strengthen your email security.

Forgetting SPF/DKIM alignment is also a common issue. It’s important to remember that DMARC is not just about having SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) configured; it requires proper alignment. This means the domain in the visible “From” address must match the domain authenticated by SPF and/or DKIM. Even if SPF and DKIM pass individually, DMARC will fail if the domains don’t align correctly. Misunderstanding or overlooking alignment can lead to unexpected failures and impact your email deliverability.

Jumping straight to a strict p=reject policy without sufficient monitoring can backfire. Without collecting data in none or quarantine mode first, you risk blocking legitimate emails, especially from third-party services like CRMs (Customer Relationship Management), marketing platforms, or support tools that may not be fully configured. A gradual approach is best: start with p=none to gather reports, carefully review and fix issues, then move to p=quarantine, and finally to p=reject once you’re confident all legitimate senders pass authentication. This staged rollout ensures smooth enforcement without disrupting your email flow.

Conclusion

DMARC is one of the most effective ways to protect your domain from phishing, spoofing, and the growing wave of AI-generated attacks. When used with SPF and DKIM, it strengthens your email security, improves deliverability, and helps you understand exactly who is sending mail on your behalf. With a proper policy in place, organizations across finance, healthcare, government, and many other sectors can keep their communications trusted and secure.

Setting up DMARC correctly takes ongoing monitoring, alignment checks, and a gradual move toward enforcement. PowerDMARC makes this easier by providing hosted authentication, easy-to-read reports, real-time alerts, and expert guidance at every step.

Our customers receive dedicated support from our in-house DMARC experts to configure solutions that fit their needs. Get in touch with us today for a free DMARC trial and start protecting your domain with confidence.

Frequently Asked Questions (FAQs)

Is DMARC required by law?

DMARC is not legally required in most countries, but many industries and organizations adopt it as a best practice to protect their email domains and customers from phishing and spoofing.

Can DMARC stop all phishing attacks?

While DMARC significantly reduces phishing by blocking unauthorized senders, it can’t stop every attack. Some phishing tactics bypass email authentication, so DMARC should be part of a broader security strategy.

How long does it take to implement DMARC?

Implementation time varies—from a few hours for basic setup to several weeks for full monitoring, policy tuning, and alignment with all email sources. Careful planning and gradual enforcement help ensure success.

“`

Latest posts by Maitham Al Lawati (see all)
What Is a DMARC Policy? None, Quarantine, and Rejectpolicy dmarcTop 5 Best Email Verification ToolsTop 7 Best Email Verification Tools for Secure Delivery