What Is DMARC and How Do You Set It Up?
DMARC builds on SPF and DKIM to give domain owners control over what happens to unauthenticated email. This guide covers how DMARC works and how to configure it safely.
ProfitTool Team
Security & Dev
What DMARC Does
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record published at _dmarc.yourdomain.com that tells the world two things:
- How to handle email that fails SPF and DKIM alignment checks
- Where to send reports about those failures
The DMARC Record Format
_dmarc.example.com IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100; adkim=r; aspf=r"Key Tags
| Tag | Meaning |
|---|---|
v=DMARC1 | Required. Version identifier. |
p= | Policy: none, quarantine, reject |
sp= | Subdomain policy (defaults to p) |
rua= | Aggregate report destination |
ruf= | Forensic report destination |
pct= | Percentage of messages subject to policy (default 100) |
adkim= | DKIM alignment: r (relaxed) or s (strict) |
aspf= | SPF alignment: r (relaxed) or s (strict) |
Alignment: The Critical Concept
DMARC requires alignment — the domain in SPF's MAIL FROM or DKIM's d= tag must match the visible From: domain.
- Relaxed (
r): subdomains match.mail.example.comaligns withexample.com. - Strict (
s): exact match only.mail.example.comdoes not align withexample.com.
Safe Rollout Strategy
Jumping straight to p=reject on a domain with active email can break legitimate messages. Follow this sequence:
Week 1–2: p=none; rua=mailto:dmarc@yourdomain.com Review aggregate reports. Identify all sending sources.
Week 3–4: p=quarantine; pct=10 Apply policy to 10% of failing messages. Monitor spam folder.
Week 5–8: p=quarantine; pct=100 Full quarantine. Continue reviewing reports.
Week 9+: p=reject Full enforcement. Unauthenticated email is rejected.
Reading DMARC Reports
Aggregate reports are sent as XML attachments (usually compressed) to your rua address. Tools like Google Postmaster, DMARC Analyzer, or Valimail help parse them visually.
Check your DMARC record now with our DMARC Checker.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
How to Read and Analyse Email Headers
Email headers contain a complete trace of every server an email passed through. This guide explains how to find headers in major email clients, what to look for, and how to detect spoofing.
Privacy & SecuritySPF vs DKIM vs DMARC: How Email Authentication Works
SPF, DKIM and DMARC work together to protect your domain from email spoofing and phishing. This guide explains what each one does and why you need all three.
Developer ToolsWhat Is a TXT Record? SPF, DKIM, DMARC & Verification
DNS TXT records carry free-form text used for SPF, DKIM, DMARC and domain verification. The format, the 255-character string limit, and common mistakes.