Guides · Updated October 26, 2026 · Not legal advice; provider rules change, so check the linked sources.

DMARC basics: none, quarantine, reject and a staged rollout

DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) lets a domain owner tell receiving mail servers what to do with mail that claims to come from their domain but fails authentication. It also lets you ask for reports about who is sending as you.

How DMARC decides pass or fail

A message passes DMARC when at least one of these is true:

• SPF passes and the SPF-checked domain (the envelope "MAIL FROM") aligns with the domain in the visible From: header.
• DKIM passes and the signing domain (d=) aligns with the From: domain.

"Relaxed" alignment, the default, accepts a match on the organizational domain, so mail.example.com aligns with example.com. "Strict" alignment (aspf=s or adkim=s) needs an exact match.

The record

DMARC is a TXT record at _dmarc.yourdomain.com, for example:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

• p=none: monitor only. Receivers deliver mail as they normally would and send you aggregate reports.
• p=quarantine: treat failing mail as suspicious, usually by sending it to spam.
• p=reject: refuse failing mail outright.
• rua=: where aggregate (daily summary) reports go.
• pct=: the percentage of failing mail the policy applies to. It's useful when you move up a stage. RFC 7489 defines it, but not every receiver honors it exactly.
• sp=: a separate policy for subdomains, if you need one.

A staged rollout

Jumping straight to p=reject can block your own legitimate mail from a service you forgot about. A safer path:

1. Monitor (p=none). Publish the record with rua and read the reports for a few weeks. Find every legitimate sender and fix its SPF or DKIM alignment.
2. Partial quarantine. Move to p=quarantine, optionally with a low pct, and keep watching the reports.
3. Full quarantine. Raise the policy to all mail (pct=100, or remove pct).
4. Reject. When the reports show only unauthorized senders failing, move to p=reject.

There's no fixed timetable. Move to the next stage when the reports show your real mail passing. Keep records of each change so you can roll back quickly.

Common mistakes

• Publishing DMARC before SPF or DKIM covers all your real senders, then going straight to enforcement.
• Having more than one DMARC record. Receivers then ignore it.
• Forgetting that forwarded mail and mailing lists can break SPF. DKIM usually survives forwarding, which is one reason to sign with DKIM everywhere.

Gmail and Yahoo now require bulk senders to publish DMARC (see the bulk-sender rules). Even p=none meets that rule, but only enforcement actually stops spoofing.