What is DMARC?

How does DMARC work?

DMARC works by tying SPF and DKIM to the address people actually see. SPF checks the hidden envelope sender and DKIM checks the signing domain, but neither looks at the From line, so on their own a scammer could pass both with their own domain while showing yours. DMARC closes that gap with three steps:

1. Find the policy. The receiving server reads the From domain and looks up the DMARC record at _dmarc.yourcompany.com.
2. Check alignment. The message passes DMARC if SPF passed for a matching domain, or DKIM passed with a matching d= domain. One is enough.
3. Apply the policy and report. If it fails, the receiver follows your policy, and it adds the result to the summary report it sends to you.

The standard describes the policy as the domain owner's "message handling preference", and receivers make the final call. In practice the large mailbox providers follow it.

What does a DMARC record look like?

A DMARC record is a DNS TXT record at _dmarc on your domain, made of tag=value pairs. A typical first record, which only collects reports, is:

v=DMARC1; p=none; rua=mailto:[email protected]

These are the tags RFC 9989 defines:

Tag	What it sets	Values (default)
v	Version; must come first	DMARC1
p	Policy for the domain	none, quarantine, reject
sp	Policy for existing subdomains	As p (same as p)
np	Policy for subdomains that don't exist	As p (sp, else p)
t	Testing: apply one level below the policy	y or n (n)
rua	Where to send aggregate reports	mailto: addresses (none)
ruf	Where to send failure reports	mailto: addresses (none)
adkim	DKIM alignment	r relaxed, s strict (r)
aspf	SPF alignment	r relaxed, s strict (r)
fo	When to send failure reports	0, 1, d, s (0)
psd	Whether this is a public suffix domain	y, n, u (u)

A record with no p tag is treated as p=none.

What do none, quarantine and reject mean?

The policy says what you'd like receivers to do with mail that fails DMARC. The standard's own wording sets the tone of each:

Policy	What it means	What usually happens to failing mail
p=none	"No expression of preference"	Delivered as normal; you still get reports
p=quarantine	Such mail is "suspicious"	Sent to the spam or junk folder
p=reject	Failure is "a clear indication" the use isn't valid	Refused during delivery

Google's rules for senders of more than 5,000 messages a day accept p=none, but only quarantine and reject actually stop someone else's mail from reaching inboxes under your name.

What changed in DMARC in 2026?

DMARC became a full internet standard. In May 2026 the IETF published RFC 9989, which replaces RFC 7489, the informational version from 2015, and moves reporting into two companion documents: RFC 9990 for aggregate reports and RFC 9991 for failure reports. The main changes for a domain owner:

• pct is gone. The old percentage tag "was usually not accurately applied" unless set to 0 or 100.
• t is new. t=y asks receivers to apply one level below your policy while you test: quarantine becomes none, reject becomes quarantine.
• np is new. It sets a separate policy for subdomains that don't exist, a favourite of spoofers.
• A DNS tree walk replaces the Public Suffix List for working out a domain's organisational domain, so receivers no longer depend on an outside list.
• psd is new. It lets the operators of suffixes such as a country domain publish policies; ordinary businesses can ignore it.

Existing records keep working: a record with pct is still valid, and receivers simply ignore tags they don't know.

How do you set up DMARC step by step?

You set up DMARC by publishing a monitoring record, reading the reports until all your real mail passes, then tightening the policy.

1. Set up SPF and DKIM first, for every service that sends as your domain.
2. Publish p=none with a rua address. Mail is unaffected; reports start arriving within a day or two.
3. Read the reports. Each one lists which servers sent mail as your domain and whether it passed. Find your own services that fail and fix them.
4. Move to p=quarantine with t=y, then drop t=y once nothing legitimate fails.
5. Move to p=reject, the setting that actually stops your domain being forged.

Small businesses with one email provider can often go from none to reject in a few weeks; those with many sending tools take longer, because each tool needs its own SPF or DKIM set up first.

What is a DMARC aggregate report?

An aggregate report is a daily summary, sent by each large receiver that got mail claiming to be from your domain. It's an XML file listing each sending IP address, how many messages it sent, and whether SPF, DKIM and DMARC passed. It contains no message content. Most domain owners send reports to a DMARC report service that turns the XML into a readable table, because a busy domain receives dozens a day.

How does Mojobase handle DMARC?

When Mojobase hosts email on your own domain, its domain page lists every record your domain needs, DMARC included, and checks each one, so you can see whether your mail authenticates before you tighten the policy. Mojobase signs hosted mail with your domain's DKIM key, so it aligns with your From address as DMARC requires.

If you keep Gmail or Outlook and connect it instead, your existing DMARC record keeps working unchanged. Either way, every address sits in one Mojobase inbox, sorted and drafted by the same AI. More on business email on your own domain.