What is DMARC and how to deploy it without losing mail

How DMARC works

SPF checks whether the sender's server is on the list of allowed servers. DKIM checks the message's digital signature (DKIM guide). Neither of them looks at the address in the "From" field that the recipient sees. DMARC ties both mechanisms to that address: a message passes DMARC when SPF or DKIM gives a positive result for the same domain that appears in the "From" field. This match is called alignment; in the default mode the same organizational domain is enough, so mail from news.yourcompany.com is aligned with yourcompany.com.

For messages that fail DMARC, the recipient's server applies the policy from your record. Separately, usually once a day, it sends an aggregate report about all mail seen on behalf of your domain, including mail that passed.

An example record

You add the record as TXT under the name _dmarc (full name: _dmarc.yourcompany.com):

v=DMARC1; p=none; rua=mailto:[email protected]

• p is the policy: none (reports only), quarantine (to spam), reject (refuse).
• rua is the address for aggregate XML reports, usually sent once a day by large mail receivers (how to read them).
• pct is the percentage of messages the policy applies to; 100 by default. The new version of the standard (RFC 9989, May 2026) replaces it with a testing mode t, but receivers still widely understand pct.
• sp is a separate policy for subdomains; without it subdomains inherit p.

Roll out without losing mail

1. Clean up SPF and enable DKIM at all services that send mail with your domain.
2. Publish DMARC with p=none and a rua address. Nothing is blocked yet.
3. Read the reports for at least 2-4 weeks, longer if you send rarely (for example invoices once a month). You are looking for legitimate senders that fail DMARC (say, a forgotten invoicing program) and fixing their settings.
4. Change the policy to p=quarantine. After another period without problems move to p=reject. Only p=reject tells receivers to refuse spoofed messages.

The most common mistakes

• The record added under the bare domain instead of _dmarc. For receivers, DMARC then does not exist.
• Two DMARC records at once. Receivers ignore both.
• A rua address in another domain without that domain's consent. The report receiver must confirm it with a separate record in its own DNS; report analysis services do this automatically.
• Staying on p=none for years. Such a record only observes and does not protect against spoofing.

The DMARC generator prepares a ready-to-paste record, and the DMARC checker verifies what you have published. XML reports are hard to read without a tool, so use a DMARC report service or your email provider's report viewer.