What is DMARC? Implementing SPF, DKIM & DMARC Policies

The Email Authentication Trinity: SPF, DKIM & DMARC

Email protocol (SMTP) was originally engineered without native identity verification, allowing malicious actors to easily forge sender headers. DMARC (Domain-based Message Authentication, Reporting, and Conformance) provides the mechanism for domain owners to publish enforcement policies.

Inbound Email Received
         │
         ├──▶ 1. Check SPF (Is sending IP authorized?)
         ├──▶ 2. Check DKIM (Is cryptographic signature valid?)
         │
         ▼
3. Evaluate DMARC Alignment
         │
    ┌────┴──────────────────────────┐
    ▼                               ▼
[Pass Alignment]            [Fail Alignment]
  Deliver to Inbox            Enforce Policy:
                              • p=none (Deliver & Report)
                              • p=quarantine (Spam Folder)
                              • p=reject (Drop Message)

Structure of a DMARC Record

DMARC records are published as TXT records at the subdomain `_dmarc.yourdomain.com`:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100; sp=reject"

• `v=DMARC1`: Protocol identifier (required).
• `p=`: Policy action for the root domain (`none`, `quarantine`, `reject`).
• `rua=`: Destination URI for aggregate XML feedback reports.
• `ruf=`: Destination URI for forensic/failure failure reports.
• `pct=`: Percentage of messages subject to filtering (default: 100).
• `sp=`: Policy action for subdomains.

Example: What Happens Under `p=quarantine` (Illustrative)

A domain publishes:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com"

An attacker spoofs `billing@example.com` from an unauthorized server. The recipient's mail system checks SPF (fails — the sending IP isn't in the domain's authorized list) and DKIM (fails — no valid signature), so DMARC alignment fails too. Because the policy is `p=quarantine` at 100% enforcement, the message is routed to the recipient's spam folder rather than the inbox, and a summary of the attempt lands in the `rua` mailbox days later as part of an aggregate report.

Validate DMARC Configuration

Verify if your domain has an active DMARC record and inspect SPF status using our DNS Record Analyzer.