DMARC is a DNS record that ties SPF and DKIM together. It says which check must pass for your domain and tells receivers what to do when both fail: p=none (deliver and report), p=quarantine (send to spam), or p=reject (block outright). It also requires alignment, and every message generates a report to the rua address in your record.

What does DMARC p=reject mean?

p=reject tells receiving mail servers to block mail outright when it fails SPF and DKIM with alignment. It is the strongest DMARC policy and the end state most businesses are walking toward — at p=reject, spoofed mail carrying your exact domain no longer arrives at mainstream providers.

What is DMARC alignment?

Alignment means the domain in the visible From header must match the domain that passed SPF or DKIM. Without alignment, a phisher could pass SPF using their own domain behind the scenes while displaying your domain in the From line. Alignment closes that loophole.

Learn · Email authentication

SPF, DKIM & DMARC Explained

If someone can send email that looks like it's from you, they can empty your customers' wallets using your name. SPF, DKIM, and DMARC are the three standards that stop that. Together they tell receiving mail servers two things: this message really came from your domain, and what to do with it if it didn't.

What is SPF?

SPF (Sender Policy Framework) is a DNS record that lists every server allowed to send mail for your domain. Receivers check it against the envelope sender — the return path — and mark the result pass, fail, or softfail.

v=spf1 include:_spf.google.com ~all

That record says: "Google is allowed to send for this domain; everyone else is suspicious." SPF has a blind spot, though: it only checks the envelope address, and forwarding breaks it. That's why it's the weakest of the three on its own. See SPF explained for the full picture.

What is DKIM?

DKIM (DomainKeys Identified Mail) is a digital signature. Your mail server signs every outgoing message with a private key and publishes the matching public key in DNS. The receiver verifies the signature against the From address — if it checks out, the email genuinely came from your domain, even after it was forwarded.

selector._domainkey.example.com v=DKIM1; k=rsa; p=MIGfMA0G...

DKIM proves the message wasn't tampered with in transit and that your domain sent it — but only when the key matches the domain in the From header. See DKIM explained for how selectors and keys work.

What is DMARC?

DMARC ties SPF and DKIM together. Its DNS record says which check must pass, and what receivers should do when both fail:

p=none — watch, but don't block (monitoring mode)
p=quarantine — send failures to spam
p=reject — block them outright

DMARC also requires alignment: the domain in the From header has to match the domain that passed SPF or DKIM. That's the piece that actually stops someone from using your domain in a scam. And every message generates a report to the address in your record, so you can see everyone sending as you — we explain how to read those in DMARC reports explained.

One thing to know before you start: publishing p=none doesn't block anything yet — it switches on reporting. The protection arrives when you tighten to quarantine and then reject, a process we walk through in DMARC policies explained.

How SPF, DKIM and DMARC work together

Think of it as a chain: SPF checks the return address, DKIM checks the signature, and DMARC decides what happens when either one fails — then emails you a report about it. Publish all three and enforce p=reject, and your domain becomes nearly impossible to spoof.

Why DMARC is important now

Mailbox providers require it. Since 2024, Gmail and Yahoo have required bulk senders — 5,000 or more messages a day — to implement DMARC, and Microsoft followed suit for Outlook. Without it, legitimate mail gets throttled or junked regardless of what's in it.
Deliverability. Authenticating and keeping DMARC alignment is a positive reputation signal even for small senders. Failing to authenticate quietly loses you inbox placement long before anyone notices.
Fraud prevention. Set to reject, spoofed mail carrying your exact domain no longer arrives at any mainstream provider. Phishers move on to lookalike domains — a much weaker attack that no longer carries the trust in your name.
Visibility. Most organizations discover forgotten senders in their first week of reports. An old CRM. A marketing tool someone signed up for. A misconfigured server.

Common misconception: publishing p=none doesn't protect you yet — mail that fails still gets delivered. It's the essential first step, because it turns on reporting so you can fix every sender safely, but the protection comes when you reach quarantine or reject.

Getting started

The safe sequence: publish DMARC at p=none with a rua address, watch the reports until every legitimate sender (your mail platform, your ESPs, your billing system) passes aligned, then tighten to quarantine and finally reject. The reports arrive as XML files designed for machines, not people — and therein lies the value of a monitoring service: it turns them into a dashboard, identifies senders by name, and flags what would break before you enforce a tighter policy.

Free checks: DMARC checker SPF checker DKIM checker Spam checker