Skip to content

What Is DMARC, and How Does It Work?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.<domain> that tells receivers what to do with mail that fails SPF or DKIM, and where to send reports about it. DMARC is what turns SPF from advisory into enforced.

Last updated August 9, 2026.

A basic DMARC record

v=DMARC1; p=none; rua=mailto:dmarc@example.com   # tighten to quarantine, then reject

rua= is where aggregate reports — daily summaries of who is sending mail as your domain, and whether it passed — are delivered. p= is the policy, and this is the tag to start conservative on: publishing p=quarantine before those reports have shown you every legitimate sender silently routes your own mail to spam. Start at p=none, read the reports, then tighten.

The three policy stages

  • p=none — monitoring only. Failing mail is delivered normally; you just get reports. This is the correct starting point, not the end state.
  • p=quarantine — failing mail is routed to spam/junk.
  • p=reject — failing mail is rejected outright. The goal state once you've confirmed every legitimate sender passes.

A record with a missing or invalid p= tag is ignored by receivers entirely — it provides no enforcement despite being present in DNS.

Rolling it out without breaking mail

  1. Publish p=none with an rua= reporting address and let reports accumulate for at least a week or two.
  2. Review the reports and confirm every legitimate sender (your mail provider, helpdesk, marketing tool, invoicing system) is passing SPF or DKIM alignment.
  3. Move to p=quarantine and watch for any drop in legitimate delivery.
  4. Move to p=reject once quarantine has run clean.

About DKIM

DKIM is a separate, complementary email-authentication mechanism that adds a cryptographic signature to outgoing mail. Nivaronix does check DKIM, as part of its DNS checks rather than the SPF/DMARC ones: it queries a short, fixed list of common selectors at <selector>._domainkey.<your-domain> and reports whether a usable DKIM public key is published at one of them. Because DKIM has no directory lookup — the selector name is chosen by whichever platform signs your mail, and there is no way to enumerate it from outside — a "no DKIM record found" result is evidence, not proof: a domain signing with a selector outside that list looks identical to a domain with no DKIM at all. Nivaronix also does not validate DKIM signatures on live mail, so this is a published-key check rather than a full DKIM audit. The DKIM guide lists the exact selectors tried. DMARC alignment can be satisfied by either SPF or DKIM passing; Nivaronix's DMARC check reports the presence and policy strength of the DMARC record itself, not which underlying mechanism a given message passed.

FAQ

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.<domain> that tells receiving mail servers what to do with mail claiming to be from your domain that fails SPF or DKIM, and where to send reports about it.

What is a DMARC record?

It's a single TXT record at _dmarc.<domain> with tags like v=DMARC1, p= (policy: none, quarantine, or reject), and rua= (where aggregate reports go). Example: v=DMARC1; p=none; rua=mailto:dmarc@example.com.

What does DMARC p=none mean?

p=none is monitoring-only: failing mail is delivered normally, but you receive aggregate reports on who's sending as your domain and whether they pass. It's the correct starting policy, not a finished configuration — a domain stuck at p=none has no actual enforcement.

What's the difference between DMARC and SPF?

SPF alone is advisory — a receiver can choose to ignore an SPF failure. DMARC is what makes that failure enforceable: it tells the receiver whether to quarantine or reject mail that fails SPF or DKIM alignment, and gives you visibility into what's failing via aggregate reports.

Why would a DMARC record have no usable policy tag?

If the p= tag is missing, misspelled, or set to an invalid value, receivers ignore the entire record — it provides zero enforcement despite technically existing in DNS. This is a common false sense of security: the record is present, but it does nothing.

Related

Check your DMARC record now

Scan your domain free