What Is DMARC?

SPF and DKIM each produce a pass or a fail, but neither says what a receiver should do about it, and neither checks the From address the reader actually sees. DMARC supplies both halves: a policy for failures, and the alignment rule that ties a passing check to the visible From domain.

Alignment is the part that stops spoofing. A message can pass SPF for a domain the sender controls while showing your brand in the From address; under DMARC that message fails, because the domain that passed is not the domain on display.

The policy tag sets the instruction. p=none asks receivers to do nothing differently and just send reports, p=quarantine asks them to treat failing mail as suspicious, usually meaning spam placement, and p=reject asks them to refuse it outright.

The normal path is to start at p=none, read the reports until every legitimate sending source is authenticated, then move to quarantine and finally to reject. Starting at reject before the reports are clean blocks your own mail.

Google and Yahoo both require an authenticated setup with a DMARC record for bulk senders to their consumer domains, a change both announced in 2024. For any sender at volume it is a practical requirement rather than a best practice.

A minimal record is enough to satisfy it. What matters more is that the reports get read, because the report stream is the only place a misconfigured sending tool or an unauthorised sender shows up before recipients notice.