Email Security

What Is a DMARC Record? Email Policy Explained

Unified DNS Team · 2026-01-12 · 9 min read

Table of Contents

What Is a DMARC Record?

A DMARC record (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record that tells receiving mail servers what to do when email fails SPF or DKIM checks. It’s the policy layer that ties SPF and DKIM together into a complete email authentication system.

The Basics

  • DMARC stands for “Domain-based Message Authentication, Reporting & Conformance”
  • Published as a TXT record at _dmarc.domain.com
  • Specifies policy for failed authentication (none, quarantine, reject)
  • Provides reporting to domain owners about authentication results
  • Addresses the weakness of SPF and DKIM being separate systems

Why DMARC Matters

Without DMARC, SPF and DKIM operate independently with no coordinated policy:

  • SPF checks the envelope sender, not the visible “From” header
  • DKIM proves the message wasn’t modified, but doesn’t enforce anything
  • Receiving servers make their own decisions about failures

DMARC provides:

  • Unified policy — Single rule for handling authentication failures
  • Domain alignment — Ensures SPF/DKIM domains match the “From” header
  • Visibility — Reports show who’s sending email as your domain
  • Enforcement — Tell receivers to reject unauthorized email

Example DMARC Record

_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com"

How DMARC Works

The Authentication Flow

  1. Email received — Mail server receives email claiming to be from user@example.com
  2. SPF check — Is the sending IP authorized?
  3. DKIM check — Is the signature valid?
  4. DMARC alignment check — Do SPF/DKIM domains align with the “From” header?
  5. Policy lookup — What does _dmarc.example.com say to do?
  6. Policy applied — None, quarantine, or reject based on DMARC record
  7. Report generated — Results sent to addresses in rua/ruf tags

DMARC Alignment

DMARC requires alignment — the domain in SPF or DKIM must match the “From” header domain:

SPF Alignment:

  • Envelope sender domain must match “From” header domain
  • Relaxed: example.com matches mail.example.com
  • Strict: example.com must exactly match

DKIM Alignment:

  • DKIM signing domain (d=) must match “From” header domain
  • Relaxed: subdomain matches parent domain
  • Strict: exact match required

DMARC Pass Requires:

  • SPF passes AND aligns, OR
  • DKIM passes AND aligns

Example: Email From: user@example.com

CheckDetailsResult
SPFEnvelope From: mail.example.com
Sending IP authorized?Yes
Aligned with example.com?Yes (relaxed)
SPF ResultPASS + ALIGNED
DKIMd=example.com
Signature valid?Yes
Aligned with example.com?Yes
DKIM ResultPASS + ALIGNED
DMARCPASS (both SPF and DKIM aligned)

DMARC Record Structure

Record Location

DMARC records are always at _dmarc.domain.com:

_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

DMARC Tags

TagRequiredDescription
vYesVersion (always DMARC1)
pYesPolicy for domain (none, quarantine, reject)
spNoPolicy for subdomains
ruaNoAggregate report destination
rufNoForensic report destination
adkimNoDKIM alignment mode (r=relaxed, s=strict)
aspfNoSPF alignment mode (r=relaxed, s=strict)
pctNoPercentage of messages to apply policy
foNoForensic report options
riNoReport interval in seconds

Complete Example

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1; ri=86400"

DMARC Policies Explained

p=none (Monitor Only)

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
  • Action: No enforcement, email delivered normally
  • Use case: Initial deployment, monitoring
  • Reports: Shows what would be affected by enforcement

p=quarantine

_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
  • Action: Suspicious email sent to spam/junk folder
  • Use case: Intermediate step before full enforcement
  • Impact: Users may miss some email

p=reject

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
  • Action: Unauthorized email is rejected (bounced)
  • Use case: Full protection, production deployment
  • Impact: Spoofed email blocked completely

Gradual Enforcement with pct=

Roll out enforcement gradually:

; Start: Monitor only
_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; Step 2: Quarantine 25% of failures
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

; Step 3: Quarantine 50%
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com"

; Step 4: Quarantine 100%
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

; Step 5: Reject 25%
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.com"

; Final: Reject 100%
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Subdomain Policy (sp=)

Control subdomains separately:

; Reject for main domain, quarantine for subdomains
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com"

; Reject for all, including subdomains
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"

Understanding DMARC Reports

Aggregate Reports (rua)

Daily XML reports showing:

  • Who sent email as your domain
  • SPF/DKIM/DMARC pass/fail rates
  • Sending IP addresses
  • Email volumes
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Example aggregate report data:

  • Google sent 1,500 emails: 1,495 DMARC pass, 5 fail
  • Unknown IP 198.51.100.99 sent 50 emails: 0 pass, 50 fail (potential spoofing!)

Forensic Reports (ruf)

Individual failure reports with email details:

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1"

fo= options:

  • 0 — Generate report if all mechanisms fail (default)
  • 1 — Generate report if any mechanism fails
  • d — Generate report if DKIM fails
  • s — Generate report if SPF fails

Note: Many providers don’t send forensic reports due to privacy concerns.

Using DMARC Report Analyzers

Raw DMARC reports are XML and hard to read. Use analysis tools:

  • Valimail — Free DMARC monitoring
  • Dmarcian — Detailed analytics
  • Postmark DMARC — Free weekly digests
  • DMARC Analyzer — Comprehensive reporting

DMARC Implementation Guide

Phase 1: Assessment

  1. Inventory all email sources:

    • Main email platform (Microsoft 365, Google Workspace)
    • Marketing platforms (HubSpot, Mailchimp, etc.)
    • Transactional email (SendGrid, Postmark)
    • Internal applications
    • Third-party services sending as your domain

  2. Verify SPF is configured:

    dig TXT example.com | grep spf

  3. Verify DKIM is configured:

    dig TXT selector1._domainkey.example.com

Phase 2: Monitor

Deploy DMARC in monitor mode:

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
  • Collect reports for 2-4 weeks
  • Identify all legitimate email sources
  • Fix SPF/DKIM for any failing sources

Phase 3: Quarantine

Start enforcement gradually:

; Start with 25% quarantine
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

; Increase to 50% quarantine
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com"

; Full quarantine
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Monitor for legitimate email going to spam.

Phase 4: Reject

Full enforcement:

; Gradual reject
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.com"

; Full reject
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Best Practices for MSPs

1. Always Start with p=none

Never deploy DMARC with enforcement immediately:

  • You’ll break legitimate email
  • Users will complain
  • You won’t know what you’re missing

2. Use a DMARC Report Analyzer

Raw reports are unusable. Use tools like:

  • EasyDMARC (paid, MSP-friendly)
  • Valimail (free tier)
  • Postmark DMARC (free)
  • Dmarcian (paid, detailed)

3. Fix SPF and DKIM First

DMARC is only as good as your SPF and DKIM:

  • Ensure SPF includes all sending sources
  • Enable DKIM on all email platforms
  • Verify both pass before enabling DMARC enforcement

4. Account for Email Forwarding

Email forwarding breaks SPF (and sometimes DKIM):

  • DKIM survives forwarding better than SPF
  • Some forwarding breaks DKIM body hashes
  • Consider relaxed alignment (default) vs strict

5. Don’t Forget Subdomains

Attackers often spoof subdomains. Use sp= tag:

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"

6. Monitor Continuously

DMARC isn’t “set and forget”:

  • New email services may be added
  • Configurations change
  • Attackers try new techniques

7. Use Unified DNS for DMARC Monitoring

Managing DMARC across dozens of client domains requires visibility. Unified DNS provides:

  • DMARC policy status for all clients at a glance
  • Alerts for policy changes
  • Compliance tracking dashboard
  • Documentation synced to Hudu

Troubleshooting DMARC

Legitimate Email Failing DMARC

Check alignment:

  • Is the envelope sender domain the same as the “From” domain?
  • Is DKIM signing with the correct domain?

Common causes:

  • Third-party service using their domain for envelope sender
  • DKIM not configured or using wrong selector
  • SPF not including the sending service

Not Receiving DMARC Reports

Verify rua address:

dig TXT _dmarc.example.com

Check:

  • Correct mailto: format
  • Email address can receive email
  • Reports may take 24-48 hours to arrive
  • Some senders don’t send reports

Testing DMARC

Query DMARC record:

dig TXT _dmarc.example.com +short

Send test email:

  1. Send to Gmail
  2. View original message
  3. Look for “DMARC: PASS”

Online tools:

  • mxtoolbox.com/dmarc.aspx
  • dmarcanalyzer.com/dmarc/dmarc-record-check

Frequently Asked Questions

Do I need SPF and DKIM before DMARC?

You need at least one (SPF or DKIM) configured and passing for DMARC to work. Best practice is to have both.

What policy should I use?

  • p=none — Start here for monitoring
  • p=quarantine — After fixing all legitimate sources
  • p=reject — Final goal for full protection

Most organizations should aim for p=reject.

How long should I stay at p=none?

2-4 weeks minimum, longer for complex organizations. You need enough report data to identify all legitimate senders.

Will DMARC break my email?

If implemented correctly with monitoring first, no. If you deploy p=reject immediately without checking reports, yes.

Do I need DMARC for subdomains?

Yes! Attackers often target subdomains. Use sp=reject to protect them.

What’s the difference between DMARC and BIMI?

DMARC is authentication policy. BIMI (Brand Indicators for Message Identification) displays your logo in email clients but requires DMARC at p=quarantine or p=reject first.

Is DMARC required for compliance?

Increasingly yes:

  • PCI-DSS recommends DMARC
  • Many cyber insurance policies require it
  • Government contractors may require it
  • Google and Yahoo now require DMARC for bulk senders

Get Started with Unified DNS

DMARC is essential for email security and increasingly required for compliance. Unified DNS lets you view, modify, audit, and backup DMARC records across all your clients — with a compliance dashboard showing DMARC policy status, monitoring for configuration issues, and Hudu documentation syncing built in.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.