Skip to main content

DMARC

Long tables of catalogue cards being sorted in the Card Division of the Library of Congress, early twentieth century

Domain-based Message Authentication, Reporting and Conformance — email policy that tells receivers what to do when SPF/DKIM fail alignment.

Platform & Operations. Last reviewed July 2026.

Ask an engineerAll terms

In this entry

A printer’s case of metal type sorted into compartments, labelled Scotch Roman (Pica) Caps

2serious gotchas

1regular gotcha

3tips

Definition

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT policy on _dmarc.example.com that tells receiving mail systems what to do when a message claiming your domain fails SPF and/or DKIM alignment. Policies climb a ladder: p=none (monitor), p=quarantine, p=reject. Aggregate (rua) and forensic (ruf) reports help you find unauthorized senders before enforcement.

When to use it

  • Any domain that sends production email (transactional or marketing)
  • Meeting Google/Yahoo/Microsoft bulk-sender minimums (at least p=none with working SPF+DKIM)
  • As a prerequisite for BIMI (typically needs enforcement-level DMARC)

When not to use it

  • Jumping straight to p=reject before all legitimate senders (ESPs, CRMs, ticketing) are aligned — you will quarantine your own mail
  • Publishing DMARC without collecting and reading rua reports for several weeks

Tips

  • Start at p=none, inventory failures, then raise pct and policy carefully
  • Require alignment (organizational domain match) — SPF/DKIM “pass” alone is not enough for DMARC pass
  • Prefer a dedicated reporting mailbox or SaaS parser; raw XML volume grows fast

Gotchas

Serious

  • Multiple ESPs sending as @brand.com without DKIM/SPF alignment → enforcement blocks real campaigns
  • Treating p=none as “done” forever while spoofing continues

Regular

  • Forgetting subdomains (sp= policy) used by legacy apps

Related FactualMinds content

The long reading room of Harvard’s Widener Library in 1920, rows of readers at lamplit tables
Widener Library reading room, 1920

More in Platform & Operations

Related services

Reading

Ask

Our AWS-certified team implements, audits and tunes DMARC in production. Tell us what you are building.

Pictures:James Murray in the Scriptorium (public domain); Card Division of the Library of Congress, 1900–1920 (public domain); Salle des catalogues, Bibliothèque Mazarine, Paris, Marie-Lan Nguyen (CC BY 2.0); Copyright card catalog drawer, Michael Holley Swtpc6800 (public domain); Type in sort case, Edinburgh City of Print (CC BY 2.0); Widener Library reading room, 1920 (public domain). Via Wikimedia Commons.