DMARC (Domain-based Message Authentication)
What is DMARC (Domain-based Message Authentication)?
An RFC 7489 authentication policy published at `_dmarc.yourdomain.com` that requires identifier alignment between your visible `From:` domain and your authenticated SPF or DKIM domain, while instructing receiving servers how to handle unauthenticated mail (`p=none`, `p=quarantine`, or `p=reject`).
Why DMARC (Domain-based Message Authentication) Matters in Production
Since February 2024, Gmail, Yahoo, and Microsoft require all bulk senders to publish a valid DMARC record. Without DMARC enforcement (`p=quarantine` or `p=reject`), phishing attackers can spoof your exact brand domain, and your legitimate campaigns face higher spam filtering.
Engineering & Sender Best Practices
- • Start with `v=DMARC1; p=none; rua=mailto:[email protected];` only long enough to audit legitimate sending sources.
- • Graduate to `p=quarantine; pct=100;` and then `p=reject;` once all ESPs and transactional services pass DKIM alignment.
- • Ensure strict or relaxed alignment (`adkim=r; aspf=r;`) matches your custom `Return-Path` and `DKIM-Signature` domains.
- • Pair `p=quarantine` or `p=reject` with BIMI if you want verified brand logos displayed in Gmail and Apple Mail.
Graduating Safely from p=none to p=reject Without Breaking Legitimate Mail
An enterprise SaaS company publishing v=DMARC1; p=none discovered through 14 days of aggregate RUA XML reports that their Zendesk support portal and Stripe invoice emails were sending with unaligned Return-Path domains. After enabling custom DKIM CNAME records in Zendesk and Stripe and confirming 100% DKIM alignment, they stepped up to p=quarantine and then p=reject without losing a single customer email.
Technical Implementation & Wire Example
; DMARC Policy Record enforcing quarantine on unaligned messages
_dmarc.yourdomain.com. 3600 IN TXT "v=DMARC1; p=quarantine; sp=reject; pct=100; adkim=r; aspf=r; rua=mailto:[email protected]"Publishing a DMARC policy at _dmarc.yourdomain.com protects your domain from spoofing and satisfies Gmail/Yahoo sender mandates.
DNS Email Authentication & Routing Protocol Reference
Gmail, Yahoo & Microsoft 365 Bulk Sender Standards| Protocol | DNS Host & Type | RFC Spec | Operational Requirement & Failure Impact |
|---|---|---|---|
| MX | @ (IN MX) | RFC 5321 / 7505 | Routes inbound mail by priority; missing or Null MX (0 .) causes 100% hard bounce |
| SPF | @ / Return-Path (IN TXT) | RFC 7208 | Authorizes sending IPs/ESPs; must stay strictly ≤10 DNS lookups to avoid PermError |
| DKIM | selector._domainkey (TXT/CNAME) | RFC 6376 | 2048-bit cryptographic header signature; survives email forwarding intact |
| DMARC | _dmarc (IN TXT) | RFC 7489 | Enforces From-domain alignment (p=none, p=quarantine, p=reject) + RUA reports |
| ARC / BIMI | default._bimi (IN TXT) | RFC 8617 | Preserves auth across forwarders (ARC) and displays verified brand logos (BIMI) |
SPF, DKIM, and DMARC Explained: How to Move Safely to p=reject →
Understand DMARC identifier alignment, aggregate RUA reports, and how to progress from p=none to p=reject.
Free Authentication & DNS Tools & Workflows
Frequently Asked Questions About DMARC (Domain-based Message Authentication)
Does DMARC require both SPF and DKIM to pass, or just one?
DMARC operates on an "either/or with alignment" rule: a message passes DMARC if EITHER SPF passes with an aligned Return-Path domain OR DKIM passes with an aligned d= signature domain (though passing both is best practice for resilience).
What is the difference between relaxed (r) and strict (s) DMARC alignment?
Under relaxed alignment (adkim=r; aspf=r), any subdomain of your organizational domain aligns (e.g., mail.company.com aligns with From: [email protected]). Under strict alignment (adkim=s; aspf=s), the authenticated domain must match the exact From: header hostname character for character.
Is DMARC p=none enough for Gmail and Yahoo bulk sender compliance, or do I need p=reject?
Gmail and Yahoo mandate at least p=none for bulk senders (>5,000 emails/day), but p=none offers zero protection against domain spoofing and does not qualify for BIMI brand logos (which require p=quarantine at pct=100 or p=reject).
Closely Related Terms
Explore All Email Verification Terms (A–Z)
Glossary Index →Ready to start verifying emails?
Get 1,000 free credits when you sign up. No credit card required.