DMARC is an email authentication protocol that works on top of SPF and DKIM to prevent email spoofing and give domain owners visibility into authentication failures. It lets you publish a policy in DNS that tells receiving mail servers whether to reject, quarantine, or allow messages from your domain that fail authentication alignment checks.
You publish a DMARC policy as a TXT record at _dmarc.example.com. The policy specifies what action to take (p=reject, p=quarantine, or p=none), where to send aggregate reports (rua=), and what percentage of mail the policy applies to (pct=).
When a message arrives claiming to be from your domain, the receiver checks whether the visible From: header domain aligns with the domain validated by SPF or DKIM. If alignment passes, the message is allowed. If alignment fails and your DMARC policy is set to reject or quarantine, the receiving server blocks or junks the mail. Reports are sent back to you showing authentication results across the internet.
Example DMARC record:
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"
This tells receivers to quarantine mail claiming to be from example.com that fails authentication alignment, and send aggregate reports to the specified address.
WarningMany domains publish DMARC with
p=noneto monitor via reports, but never enforce (p=quarantineorp=reject). Without enforcement, your domain remains spoofable. Also, third-party senders (marketing platforms, forwarders) often break SPF/DKIM alignment, so test thoroughly before turning on enforcement.
Use the DMARC generator to help build your policy record.