DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS-published email policy that tells receiving servers how to treat messages failing SPF or DKIM checks aligned with the sender's domain.
Also called: DMARC, Domain-based Message Authentication, Reporting and Conformance
Why it matters
DMARC builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the domain in the visible From address. The domain owner publishes a TXT record at _dmarc.example.com with a policy of none, quarantine or reject, which tells receivers to take no action, treat failures as suspicious, or refuse them.
For outbound teams, DMARC protects the sending domain from spoofing and is part of what mailbox providers check when deciding whether to trust bulk mail. The record can also request aggregate reports, sent to an address the owner chooses, that show which servers send mail using the domain. Teams often start at none, read the reports, then tighten the policy.
Example
A company sends sales email from outreach.example.com. It publishes SPF and DKIM records, then adds a DMARC TXT record with the policy set to none and a reporting address. After reviewing reports for a few weeks and fixing one unlisted sending tool, it changes the policy to quarantine so spoofed messages land in spam.
Turn the definition into a working system.
We build the GTM Engineering systems behind terms like this one. Tell us where your pipeline breaks and we will show you what we would fix first.
