What Is DMARC? Records, Policies, and the Path to Enforcement

Email spoofing works because SMTP, left alone, lets anyone put your domain in the From line. DMARC is the DNS record that closes that hole: it ties SPF and DKIM to the address recipients see and tells receiving servers what to do when a message fails the check. This guide covers how the protocol works, what every tag in the record means, and how to get from monitoring to enforcement without losing legitimate email along the way.

TL;DR

• DMARC in one line. A DNS TXT record that tells receiving mail servers how to handle email that fails SPF and DKIM alignment checks for your domain.
• Three policies. p=none monitors, p=quarantine sends failures to spam, p=reject blocks them outright.
• It's now required for bulk senders. Google and Yahoo enforce it, and Microsoft joined them in May 2025.
• Rollout takes months. Start at p=none, read the reports, fix legitimate senders, then tighten.

What DMARC Stands For and Why It Exists

DMARC is short for Domain-based Message Authentication, Reporting and Conformance. It's an open standard, published as RFC 7489 in 2015, and it fixes a specific weakness: SPF and DKIM can both pass on a message that still fakes the visible From address.

Here's the hole. SPF checks the domain in the hidden envelope sender, the Return-Path that recipients never see. DKIM checks whichever domain signed the message. Neither check has to match the From address your users read in their inbox. An attacker can pass both with a domain they own and still display yours.

DMARC closes the hole with a concept called alignment. The domain that passed SPF or DKIM must match the domain in the From header. Pass one aligned check and the message passes DMARC. Fail both and your published policy decides what happens next: deliver, quarantine, or reject.

The stakes carry a dollar figure. The FBI's IC3 logged close to $2.8 billion in reported business email compromise losses in 2024, across 21,442 complaints. The bureau's September 2024 PSA put cumulative exposed BEC losses at $55 billion since 2013. Spoofed domains are a standard entry point for that fraud, and a spoofed invoice that lands is also an incident-response problem, which is where a tested response plan earns its keep.

How DMARC Works With SPF and DKIM

When a message arrives claiming to be from your domain, the receiving server pulls three DNS records: your SPF record, the DKIM public key for whichever selector signed the message, and your DMARC record at _dmarc.yourdomain.com. SPF answers whether the sending IP is authorized. DKIM answers whether the signature verifies. DMARC then runs the check the other two skip: whether either passing domain aligns with the From header.

Alignment comes in two strictness levels. Relaxed alignment, the default, accepts a subdomain match, so mail.yourdomain.com aligns with yourdomain.com. Strict alignment requires an exact match. You control this per mechanism with the adkim and aspf tags, and relaxed is the right call for nearly every setup.

One aligned pass is enough. A message that fails SPF because a forwarder changed the sending IP still passes DMARC if the DKIM signature survives, and DKIM usually survives forwarding. That redundancy is deliberate. It's also why publishing DKIM matters even when your SPF record is airtight.

Mike Chapple's CertMike walkthrough above covers the full SPF, DKIM, and DMARC chain if video is how your team learns best.

Reading a DMARC Record

A DMARC record is a TXT record published at _dmarc.yourdomain.com. A working example:

css
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; pct=50; adkim=r; aspf=r

Every tag has a job, and two of them do most of the work.

The two that matter are p and rua. Publish a policy without a rua address and enforcement still works, but you lose the reporting stream that tells you what enforcement is doing to real traffic. Publish rua without ever reading the reports and you get the same outcome with extra steps.

The sp tag deserves more attention than it gets. Forgetting it means every subdomain inherits the root policy, which is what you want at enforcement and exactly what breaks a staging server that quietly sends unauthenticated alerts. Attackers probe forgotten subdomains for a reason: a locked front door means little when spoofed@dev.yourdomain.com sails through.

None, Quarantine, and Reject: The Three Policy Modes

One nuance before you lean on pct: not every receiver honors it. Some providers treat any quarantine policy as full quarantine regardless of the percentage, so a pct=10 ramp can behave like pct=100 for part of your audience. Use it as a softener, plan as if it doesn't exist, and let the report data confirm which one you got.

p=none has a reputation as DMARC theater, and staying there forever deserves the label. As a starting point it's correct: delivery changes for nobody while the reporting stream reveals every service sending mail as your domain, including the marketing platform someone connected in 2021 and forgot. The trap is treating the record as the finish line.

The numbers show how common that trap is. Red Sift's December 2025 analysis found roughly 2.5% of domains worldwide enforcing p=reject, and EasyDMARC's 2026 adoption report counted 52.1% of 1.8 million analyzed domains publishing DMARC while a far smaller share enforces anything. A p=none record satisfies a compliance checkbox and stops zero spoofed messages.

The same report shows the split tracks company size. Among the Fortune 500, 95% publish DMARC and more than 80% of those sit at an enforcement policy, while only 15.2% of Inc. 5000 firms have reached p=reject. Mid-market domains, the exact companies MSPs serve, are furthest behind on the one control that blocks exact-domain spoofing.

What DMARC Reports Tell You

Aggregate reports, the rua stream, are XML files receiving providers send about once a day. Each one lists the IP addresses that sent mail claiming your domain, message counts, and the SPF, DKIM, and alignment results for each source. No message content and no recipient lists, so sharing them with a processing tool doesn't leak your mail.

Forensic reports, the ruf stream, were designed to carry redacted copies of individual failing messages. Privacy regulation gutted them, and major providers now send few or none. Build your process around aggregates and treat any forensic data as a bonus.

Raw XML is readable exactly once before the novelty wears off. Free parsers summarize the stream, and paid dashboards add history and alerting. Whatever the tooling, the job is unchanged: identify every legitimate sender, get each one signing DKIM with an aligned domain, and watch the failure column shrink until what remains is spoofing you can reject with confidence.

Reports also answer the question a spoofing victim asks first: who is sending as us, and from where. A domain that has never checked its rua stream routinely discovers unauthenticated mail from three or four forgotten services, plus a steady background hum of forged mail from networks it has never touched. The first report batch is usually the moment DMARC moves from a compliance chore to a security control someone cares about.

Why Google, Yahoo, and Microsoft Forced the Issue

For a decade DMARC was a best practice without a deadline, and adoption moved accordingly. Then the mailbox providers turned it into an entry requirement. In February 2024, Google and Yahoo began enforcing rules for bulk senders, defined as 5,000 or more messages a day to their consumer addresses: SPF and DKIM in place, a DMARC record at p=none minimum, and From-header alignment. Google's sender guidelines spell out the escalation, from temporary rejections to permanent ones.

Microsoft followed on May 5, 2025 for outlook.com, hotmail.com, and live.com recipients, and it went further than junk-foldering: non-compliant bulk mail gets a 550 5.7.515 rejection at the SMTP level. The message never reaches spam. It never reaches anything.

The thresholds also matter less than they sound. The 5,000-message line counts a domain's total daily volume to each provider, marketing and transactional combined, and providers have signaled the requirements will keep expanding toward smaller senders. Building to the bulk-sender standard now, whatever today's volume, costs the same work and skips the emergency later.

The practical effect is that DMARC stopped being a security nice-to-have and became table stakes for deliverability. A client who runs a newsletter, invoices through an accounting platform, or emails a 5,000-person customer list crosses the bulk threshold without noticing. When their mail starts bouncing, deliverability becomes a ticket, the ticket becomes an escalation, and the escalation lands on whoever manages their IT.

How to Roll Out DMARC Without Breaking Email

The rollout is a sequence, and skipping steps is how legitimate mail ends up in quarantine. The sequence:

1. Inventory your senders. Mail server, marketing platform, CRM, ticketing system, invoicing tool, monitoring alerts. Anything that sends as the domain goes on the list.
2. Publish SPF and DKIM first. Every legitimate sender needs an SPF include or its own DKIM signature with an aligned domain. DKIM is the priority, since it survives forwarding.
3. Start DMARC at p=none with rua reporting. Nothing breaks, and the reports start arriving within a day or two.
4. Read reports and fix what fails. Expect surprises: the payroll tool nobody documented, the printer that emails scans. Give this phase 4-8 weeks minimum.
5. Step up to p=quarantine. Use pct to ramp gradually if the domain is complex, then raise it to 100.
6. Move to p=reject and keep watching. Enforcement without monitoring rots, because new SaaS senders appear every quarter.

Budget months, not days. The pace is set by how quickly you can find and fix every legitimate sender, and mature domains carry more of them than anyone expects. Rushing to p=reject in week one gets remembered for the wrong reasons, usually by the sales team whose sequences stopped landing.

Common DMARC Failures and How to Fix Them

Once reports start flowing, the same handful of failures shows up on nearly every domain. Knowing them in advance turns weeks of head-scratching into an afternoon of DNS edits.

The third-party sender case deserves the most attention because it's the most common. A marketing or invoicing platform that "supports DKIM" often signs with its own domain out of the box, which authenticates the mail but does nothing for your DMARC alignment. The setting you want is usually labeled custom domain, dedicated signing, or CNAME setup, and it's buried a few screens deep. Every platform on your sender inventory needs that switch flipped before quarantine, not after.

Before and after every policy change, run the domain through a DMARC checker to confirm the record parses, sits at the right hostname, and contains exactly one policy. Syntax errors fail silently: receivers treat a malformed record as no record, and the reports that would have told you so never arrive.

Rolling Out DMARC Across Client Domains

For an MSP the math multiplies: every client domain needs the same six steps, the same report reviews, and the same quarterly re-checks. That's bad news for a one-off project mindset and good news for a runbook. DMARC baselining, enforcement projects, and ongoing monitoring package cleanly as a security service, and the mailbox-provider deadlines hand you the urgency without any manufactured fear.

The delivery model matters more than the parser you pick. Standardize the record templates, keep DNS change access documented per client, and put report review on a recurring schedule instead of a memory. Teams running OpenFrame, Flamingo's AI-native all-in-one MSP/IT platform, keep that runbook inside the platform's native PSA: rollout as a project template, report review as a recurring ticket, policy changes tracked alongside the rest of service delivery. No separate project tracker, and no lock-in deciding the tooling for you.

Spoofing protection also plays better as part of a layered pitch than as a standalone line item. Exact-domain spoofing dies at p=reject, but lookalike domains and credential theft don't, so pair enforcement with credential hygiene; our password manager review for MSPs covers that layer with real pricing.

DMARC is the rare control where a DNS entry plus patience buys a measurable drop in fraud exposure, and where doing nothing now returns bounce messages instead of silence. Publish the record this week, read the reports next month, and tighten the policy each quarter until spoofing your domain stops being worth an attacker's time. For the layers DMARC doesn't touch, from gateway filtering to inbox defense, our email security guide picks up where the protocol stops.