DMARC
A DNS-published policy that ties SPF and DKIM to the visible From domain, tells receivers how to treat mail that fails, and asks them for reports.
What it means
DMARC answers the question SPF and DKIM leave open: is the domain in the From address, the one people read, really the one vouching for the message? A message passes DMARC when SPF or DKIM passes for a domain that aligns with the From domain. When it fails, the receiver can apply the policy the domain owner published at _dmarc.domain: none, quarantine or reject.
The record can also request aggregate reports (rua), daily summaries from receivers of every source sending as the domain, and failure reports (ruf). Reports are how owners find their legitimate senders before tightening the policy.
DMARC was first published as informational RFC 7489 in 2015. In May 2026 the IETF replaced it with a standards-track version in three parts: RFC 9989 (the protocol), RFC 9990 (aggregate reports) and RFC 9991 (failure reports). Gmail, Yahoo and Outlook.com require a DMARC record, at least p=none, from bulk senders.
Example
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)rfc-editor.org
- Google Workspace Admin Help: Set up DMARCknowledge.workspace.google.com
- Google: Email sender guidelinessupport.google.com
- Yahoo Sender Hub: Sender best practicessenders.yahooinc.com
- Outlook.com Postmaster: Troubleshootingsubstrate.office.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes