What is a dmarc?
Also called: Domain-based Message Authentication, Reporting and Conformance
DMARC is a DNS TXT record that tells receiving servers what to do with mail claiming to be from your domain that fails SPF and DKIM. Its policy is one of none, quarantine or reject, and it also requests reports on who is sending mail as your domain.
A DMARC record looks like v=DMARC1; p=reject; rua=mailto:reports@example.com. The p= value is the policy, and it is the whole point of the record: p=none only asks for reports and blocks nothing, p=quarantine sends failures to spam, and p=reject has them refused outright.
DMARC also introduces alignment, which is what makes SPF and DKIM useful. It requires that the domain which passed authentication matches the domain in the visible From header — closing the gap that let a spammer pass SPF for their own domain while displaying yours.
Since 2024, Google and Yahoo require a DMARC record on any domain sending bulk mail. Publishing p=none satisfies that requirement while you read the reports, but leaving it at p=none indefinitely means anyone can still spoof you.
Last reviewed 2026-09-11