Email authentication

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with email that claims to be from you but fails authentication — and sends you reports about it.

Updated · Published by HostFaddy · 3 min read

Check your DMARC policy now

Free, no sign-up — results in seconds.

What DMARC adds to SPF and DKIM

SPF and DKIM authenticate domains that the recipient never sees. DMARC links them to the From address people actually read. A message passes DMARC if SPF or DKIM passes and the authenticated domain aligns with the From domain.

A DMARC record

_dmarc.example.co.za.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.co.za; adkim=r; aspf=r"
TagMeaning
pPolicy: none (monitor), quarantine (send to spam) or reject (block).
ruaWhere receivers send daily aggregate reports.
spPolicy for subdomains, if different.
pctPercentage of failing mail the policy applies to, for gradual rollout.
adkim / aspfAlignment mode: r relaxed (subdomains match) or s strict (exact match).

A safe rollout plan

  1. Start with p=none and a rua address. Nothing changes for delivery, but you start receiving reports.
  2. Read the reports for a few weeks. They show every service sending as your domain and whether it passes. Fix SPF includes and set up DKIM for each legitimate sender.
  3. Move to p=quarantine, optionally with pct=25 and increasing.
  4. Move to p=reject once legitimate mail consistently passes.
Jumping straight to p=reject without checking reports can block your own invoices, contact-form mail or newsletters.

Why DMARC matters now

Since 2024, Google and Yahoo have required bulk senders to publish a DMARC record (at minimum p=none) along with SPF and DKIM, and Microsoft introduced similar requirements for high-volume senders to Outlook.com in 2025. Even small businesses benefit: a DMARC policy is the main defence against criminals spoofing your domain in invoice-fraud emails.

DMARC record examples

# Monitoring only — collect reports, change nothing
v=DMARC1; p=none; rua=mailto:dmarc@example.co.za

# Quarantine a quarter of failing mail while you watch the reports
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.co.za

# Full enforcement, stricter policy for unused subdomains
v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.co.za

Reading aggregate reports

Receivers such as Google, Microsoft and Yahoo send daily XML reports to your rua address. Each report lists the sending IP addresses that used your domain, how many messages each sent, and whether SPF and DKIM passed and aligned. Look for three things:

  • Legitimate services failing — your CRM, invoicing tool or website mailer. Add them to SPF and set up DKIM for them.
  • Forwarding — mail that passed at your provider but failed after a mailing list or forwarder changed it. DKIM usually survives forwarding better than SPF.
  • Unknown senders — IPs you don't recognise sending as your domain. That's the spoofing DMARC enforcement will stop.

Raw XML is hard to read, so most people send reports to a DMARC reporting service that summarises them.

Check your DMARC record

The Email Deliverability Checker finds your DMARC record and tells you whether the policy is enforced, monitoring-only or missing.

Frequently asked questions

Is p=none useful?

Yes, as a starting point: it gives you reports without affecting delivery. It doesn't protect against spoofing until you move to quarantine or reject.

Where does the DMARC record go?

On the _dmarc subdomain, e.g. _dmarc.example.co.za, as a TXT record.

Who reads the DMARC reports?

They're XML files. Many free and paid services turn them into readable dashboards — send rua to one of those or to a mailbox you check.