DMARC Explained: Policies, Alignment and Reports

DMARC, Domain-based Message Authentication, Reporting and Conformance, sits on top of SPF and DKIM. It does two jobs. It tells receiving servers what to do with messages that claim to be from your domain but fail authentication, and it asks them to send you reports about what they see. Done well, it makes it much harder to spoof your domain and gives you visibility of everything that sends mail as you.

Alignment: the key idea

SPF and DKIM on their own check technical domains that the reader never sees. DMARC links them to the domain in the visible From address. A message passes DMARC if at least one of these is true:

• SPF passes and the envelope sender domain aligns with the From domain.
• DKIM passes and the signing domain (d=) aligns with the From domain.

Alignment can be relaxed, meaning subdomains of the same organisational domain count, or strict, meaning an exact match is required. Relaxed is the default and suits most businesses.

The DMARC record

It is a TXT record at _dmarc.yourdomain.com. A first record often looks like this:

v=DMARC1; p=none; rua=mailto:[email protected]

Tag	Meaning
p	Policy for the domain: none, quarantine or reject
sp	Policy for subdomains, if different
rua	Address for aggregate reports
ruf	Address for failure reports; support varies and many providers do not send them
pct	Percentage of failing mail the policy applies to
adkim, aspf	Alignment mode for DKIM and SPF: r (relaxed) or s (strict)

The three policies

p=none

Monitoring only. Receivers take no special action on failures, but they send reports. Start here.

p=quarantine

Failing mail should be treated as suspicious, which usually means the spam folder.

p=reject

Failing mail should be refused during delivery. This gives the strongest protection against spoofing of your domain, but only once you are sure all your legitimate mail passes.

Reading aggregate reports

Aggregate reports arrive as XML files, usually compressed, from large mailbox providers, typically once a day. They list sending IP addresses, message counts, and SPF, DKIM and DMARC results. Raw XML is hard to read, so most people use a report-processing tool or service that turns it into tables. Look for three things:

1. Legitimate sources that fail, such as a forgotten newsletter tool. These need fixing before enforcement.
2. Unknown sources that pass, which may mean someone has access to your signing keys or an old service is still sending.
3. Unknown sources that fail. These are likely spoofing attempts, and they are what enforcement is meant to stop.

A safe rollout

1. Weeks 1 to 4: publish p=none with an rua address. Collect reports.
2. Inventory every legitimate sender. Fix SPF includes and DKIM for each service until their mail aligns.
3. Move to quarantine with a low pct value, such as 10, and raise it step by step while watching for complaints about missing mail.
4. Move to reject once reports show only illegitimate failures.
5. Keep reading reports. New tools and changes can break alignment later.

There is no single correct timetable. A small domain with one mail server can move quickly. A company with many marketing and support tools needs longer.

Common mistakes

• Setting p=reject on day one and blocking your own newsletters.
• Pointing rua at a mailbox that is full or does not exist.
• Forgetting subdomains. If you do not set sp, subdomains inherit the main policy.
• Publishing two DMARC records. There must be only one.
• Sending reports to an address on a different domain without the authorisation record that the receiving domain must publish.

Why it matters now

Large mailbox providers have raised their expectations for senders. Publishing a DMARC record is increasingly treated as a minimum, particularly for senders who send in volume. Even for a small business, it protects customers from fake invoices that appear to come from you.

A worked example

Imagine a small shop that sends staff mail from its mail host, newsletters from a marketing tool, and receipts from its web shop. After a month of reports at p=none, the owner sees that the host passes, the web shop passes, and the newsletter tool fails alignment because it signs with its own domain. The owner follows the tool's custom domain instructions, publishes the DKIM records it provides, and the next week of reports shows all three sources passing. Only then is it safe to move to quarantine. The reports also show a handful of messages from an unknown server in another country that fail every check. That is the traffic that enforcement will block.

Subdomains and parked domains

Attackers do not only forge your main domain. They also use subdomains and domains you own but do not use for mail. For every domain that sends no email, publish a strict policy, for example p=reject, together with an SPF record that authorises nothing. It takes a few minutes and closes an easy route for abuse.

DMARC with Zebra Hosting

Zebra Hosting's email plans let you manage the DNS records that DMARC relies on, and support in 17 languages can help you read your first reports. See the business email plans or the guidance on the security page.