Glossary
DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that tells receiving servers what to do with mail that fails both SPF and DKIM alignment with the visible From domain, and where to send reports.
What Is DMARC?
In short A DMARC record is a TXT record at _dmarc.example.com, such as v=DMARC1; p=quarantine; rua=mailto:[email protected].
A message passes DMARC when SPF or DKIM passes for a domain that matches the From domain. The p= tag sets the policy for the rest: none (no preference, just report), quarantine (treat as suspicious, usually the spam folder) or reject (refuse it).
The rua address receives aggregate reports from mailbox providers: which IPs sent mail as your domain and whether they passed. Teams start at p=none, use the reports to find every legitimate sender and fix its SPF or DKIM, then move to quarantine or reject so spoofed mail stops.
DMARC Example
Example: a company publishes v=DMARC1; p=none; rua=mailto:[email protected]. The first week of reports shows mail from Google Workspace, a billing tool and one unknown IP. It sets up DKIM for the billing tool, confirms the unknown IP is not theirs and moves to p=quarantine a month later.
DMARC in Practice
The standard changed in 2026. RFC 9989 replaced RFC 7489, with reporting split into RFC 9990 and RFC 9991. It removes the pct tag and adds np, psd and t. Google and Yahoo require a DMARC record from bulk senders, and p=none meets that requirement.
FAQ
What is a DMARC record?
A TXT record at _dmarc.example.com, such as v=DMARC1; p=none; rua=mailto:[email protected]. It sets the policy for mail that fails authentication and the address that receives reports.
What do p=none, p=quarantine and p=reject mean?
none expresses no preference, so receivers deliver as usual and send reports. quarantine asks them to treat failing mail as suspicious, usually by sending it to spam. reject asks them to refuse it. Each receiver makes the final call.
Does Gmail require DMARC?
For bulk senders, yes. Anyone sending 5,000 or more messages a day to Gmail accounts needs SPF, DKIM and a DMARC record, and p=none is enough. Yahoo asks its bulk senders for a DMARC policy of at least p=none as well.
Is RFC 7489 still the DMARC standard?
No. In 2026 the IETF published DMARC as a Proposed Standard in RFC 9989, with aggregate reporting in RFC 9990 and failure reporting in RFC 9991. RFC 9989 obsoletes RFC 7489.
Does p=none protect my domain?
No. It only collects reports. Spoofed mail is still delivered until you move to quarantine or reject.
Do This in Ken
Do This in Ken
Delivery handles DNS setup for the sending domains it provisions and checks SPF, DKIM and DMARC on every one, showing pass or fail per domain.
- Module
- Delivery
- Open in Ken
- /features
The new Ken opens to the waiting list in batches.
Related
- GTM Glossary
Every GTM term, grouped by topic.
- SPF (Sender Policy Framework)
- DKIM (DomainKeys Identified Mail)
- BIMI
- Sender reputation
- Google Postmaster Tools
- Ken
Sources
| Source | Checked |
|---|---|
| RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) | |
| Google: Email sender guidelines | |
| Yahoo Sender Hub: Sender best practices |
Changelog
- Page published.