Webmail request
en
Webmail request
nl en fr de
Deliverability

DMARC explained

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the arrangement that ties SPF and DKIM together and tells the receiving server what to do with mail that doesn't pass the check: let it through, put it in spam or reject it. In addition, DMARC sends you reports, so you can see who's emailing on behalf of your domain. That way you get a grip on your deliverability and protect your name against misuse.

By the Mailflux team Published on

Overview of sent messages with their delivery status

What exactly is DMARC?

DMARC is the third and overarching pillar of email authentication, on top of SPF and DKIM. The name stands for Domain-based Message Authentication, Reporting and Conformance. SPF and DKIM each check a piece (which server may send, and whether the message is unaltered), but they say nothing about what should happen if such a check fails. DMARC fills that gap.

DMARC does two things at once. It sets a policy: what should the recipient do with a message that doesn't pass SPF and DKIM? And it arranges reporting: you receive regular overviews of who's sending on behalf of your domain, including the parties doing so illegitimately.

There's one important concept involved: alignment. DMARC doesn't just require that SPF or DKIM passes, but also that the domain in that check matches the domain the reader sees in the sender. That way you prevent someone with a valid signature from a different name from still appearing to email on your behalf.

What does DMARC do for you?

DMARC delivers three things you genuinely benefit from.

  • Control over misuse. You decide what happens with forged mail that poses as your domain. That way you make spoofing and phishing in your name much harder.
  • Insight through reporting. The reports show which servers are emailing on behalf of your domain. Handy for recognising legitimate sources and detecting misuse.
  • Better deliverability and trust. A correct DMARC policy gives large mail providers extra assurance that your mail is genuine.

Since 2024, large mail providers have required bulk senders to publish at least a DMARC policy. If your mail ends up in spam anyway, also read why your mail ends up in spam.

How do you set up DMARC properly?

A DMARC record is a DNS record of type TXT at _dmarc.yourdomain.com. It contains your policy and the address the reports may go to.

A simplified example:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

  • v=DMARC1 indicates that it's a DMARC record.
  • p= is your policy: none (observe only), quarantine (to spam) or reject (refuse).
  • rua= is the address the summary reports go to.

The recommendation is to build up calmly:

  1. Start with p=none. You change nothing about delivery yet, but you collect reports.
  2. In those reports, see which sources email on your behalf and make sure all legitimate ones pass via SPF and DKIM.
  3. Then move to p=quarantine and eventually to p=reject once you're sure nothing legitimate gets caught anymore.

What to watch out for:

  • Never set DMARC to reject right away. Without observing first, you risk your own mail being refused.
  • Make sure SPF and DKIM are correct first. DMARC builds on them; if those aren't right, DMARC works against you.
  • Read your reports. The reporting is half the point of DMARC; don't ignore them.

Want to do it yourself? Then follow the separate guide on setting up DMARC. You'll find a concise definition in the glossary entry on DMARC.

DMARC relies on SPF and DKIM

DMARC only works if the two layers beneath it are in order: SPF determines which servers may send, DKIM signs your messages, and DMARC ties everything together with a policy and reporting. You set up all three together with the guide on setting up SPF, DKIM and DMARC together.

How Mailflux handles this for you

At Mailflux you don't have to write a policy or decipher reports yourself. We manage SPF, DKIM and DMARC for your domain and monitor the IP reputation of our sending servers, so your mail comes across reliably and your name stays protected. Every plan also filters with machine learning against spam, phishing and malware, with standard antivirus, anti-spam, anti-malware and automatic backups.

You get professional email on your own domain, hosted in Europe and GDPR-compliant, with optional two-factor authentication. The policy behind the scenes we handle.

Ready to get started?

Professional email on your own domain, hosted in Europe and GDPR-compliant. Request your mailbox with no obligation.

Get started

FAQ

Frequently asked questions

What is the difference between DMARC, SPF and DKIM?

SPF determines which servers may send on your behalf, DKIM signs your message so tampering stands out, and DMARC ties those two together: it links the check to the visible sender and determines what happens on a failed check. DMARC also adds reporting about who emails on your behalf.

What do `p=none`, `quarantine` and `reject` mean?

That's your DMARC policy. none changes nothing about delivery and only lets you observe via reports. quarantine sends failed mail to spam. reject refuses it entirely. You build up from none to reject once you're sure legitimate mail isn't caught.

What do I do with DMARC reports?

The reports show which servers email on behalf of your domain, including illegitimate use. You use them to check whether all your legitimate sources pass through SPF and DKIM, and to detect misuse. Only once that's correct do you tighten your policy step by step.

Read more