What Is DMARC, and How Does It Work?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.<domain> that tells receivers what to do with mail that fails SPF or DKIM, and where to send reports about it. DMARC is what turns SPF from advisory into enforced.
Last updated August 9, 2026.
A basic DMARC record
v=DMARC1; p=quarantine; rua=mailto:[email protected]
p=quarantine tells receivers to send failing mail to spam rather than the inbox. rua= is where aggregate reports — daily summaries of who is sending mail as your domain, and whether it passed — are delivered.
The three policy stages
- p=none — monitoring only. Failing mail is delivered normally; you just get reports. This is the correct starting point, not the end state.
- p=quarantine — failing mail is routed to spam/junk.
- p=reject — failing mail is rejected outright. The goal state once you've confirmed every legitimate sender passes.
A record with a missing or invalid p= tag is ignored by receivers entirely — it provides no enforcement despite being present in DNS.
Rolling it out without breaking mail
- Publish
p=nonewith anrua=reporting address and let reports accumulate for at least a week or two. - Review the reports and confirm every legitimate sender (your mail provider, helpdesk, marketing tool, invoicing system) is passing SPF or DKIM alignment.
- Move to
p=quarantineand watch for any drop in legitimate delivery. - Move to
p=rejectonce quarantine has run clean.
About DKIM
DKIM is a separate, complementary email-authentication mechanism that adds a cryptographic signature to outgoing mail. Nivaronix currently does not perform DKIM verification — this scan checks SPF and DMARC only. If you need DKIM validated, use your mail provider's DKIM test tool or a dedicated mail-auth checker. DMARC alignment can be satisfied by either SPF or DKIM passing; Nivaronix's DMARC check reports the presence and policy strength of the DMARC record itself, not which underlying mechanism a given message passed.