What is DMARC? The Complete Guide for 2026
Vysiro Team · October 12, 2025 · Updated March 2026 · 12 min read
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that protects your domain from being used in phishing attacks, business email compromise, and email spoofing. It works by linking together two existing authentication mechanisms — SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) — and adding a critical reporting layer that tells domain owners who is sending email on their behalf.
In practical terms, DMARC lets you publish a DNS record that tells receiving mail servers three things: how to authenticate emails from your domain, what to do with emails that fail authentication, and where to send reports about email activity. Without DMARC, anyone can send emails that appear to come from your domain — and there is nothing the receiving server can do to verify that claim.
DMARC was originally developed in 2012 by a consortium including Google, Microsoft, Yahoo, PayPal, and others. It became an internet standard (RFC 7489) and is now enforced by all major email providers.
Why DMARC Matters in 2026
DMARC has gone from "nice to have" to "mandatory" in a remarkably short time. Here is why every organization needs it now:
Google & Yahoo Requirements (February 2024)
Starting February 1, 2024, Google and Yahoo began requiring DMARC records for anyone sending more than 5,000 emails per day. Domains without DMARC see their emails throttled, sent to spam, or outright rejected. This applies to marketing emails, transactional emails, and newsletters alike.
Microsoft Enforcement (May 2025)
Microsoft followed with its own DMARC enforcement for Outlook.com, Hotmail, and Live.com. Senders without DMARC records face increasingly aggressive spam filtering. With Microsoft's market share in corporate email, this makes DMARC essential for B2B communication.
The Phishing Epidemic
Over 3.4 billion phishing emails are sent daily. Domain spoofing is the most common attack vector because it is trivially easy to forge a From address. DMARC is the only widely deployed protocol that prevents direct domain spoofing at scale.
Beyond technical requirements, DMARC also protects your brand reputation. When phishing emails appear to come from your domain, your customers and partners lose trust in your communications — even if you had nothing to do with the attack.
How DMARC Works
DMARC works by checking two things when an email arrives: SPF alignment and DKIM alignment. If at least one of these passes and aligns with the domain in the From header, the email passes DMARC. If both fail, the receiving server applies the policy you specified.
DMARC Authentication Flow
1. Email Sent
Sender sends email claiming From: you@yourdomain.com
2. Receiver Checks DNS
Receiving server looks up _dmarc.yourdomain.com TXT record
SPF Check
Is sender IP authorized? Does Return-Path domain align with From domain?
DKIM Check
Is signature valid? Does signing domain (d=) align with From domain?
3. DMARC Alignment Check
At least one (SPF or DKIM) must PASS + ALIGN with From domain
PASS
Email delivered to inbox
FAIL
Policy applied: none / quarantine / reject
SPF alignment means the domain in the Return-Path (envelope sender) matches the domain in the visible From header. SPF itself only checks whether the sending IP is authorized by the Return-Path domain — DMARC adds the alignment requirement to prevent spoofing.
DKIM alignment means the domain used in the DKIM signature (the d= tag) matches the domain in the visible From header. DKIM itself only verifies that the email was not tampered with in transit — DMARC adds the alignment requirement to confirm the signer is actually the claimed sender.
DMARC Record Tags Explained
A DMARC record is a TXT record published at _dmarc.yourdomain.com. Here is what each tag means:
| Tag | Required | Description | Example |
|---|---|---|---|
| v | Yes | Protocol version (always DMARC1) | v=DMARC1 |
| p | Yes | Policy for the domain (none, quarantine, reject) | p=reject |
| rua | Recommended | Address to receive aggregate reports (XML) | rua=mailto:dmarc@example.com |
| ruf | Optional | Address to receive forensic (failure) reports | ruf=mailto:forensic@example.com |
| sp | Optional | Policy for subdomains (defaults to p value) | sp=reject |
| pct | Optional | Percentage of messages to apply policy (1-100) | pct=100 |
| fo | Optional | Failure reporting options (0, 1, d, s) | fo=1 |
| adkim | Optional | DKIM alignment mode: strict (s) or relaxed (r) | adkim=s |
| aspf | Optional | SPF alignment mode: strict (s) or relaxed (r) | aspf=r |
DMARC Policies: none vs quarantine vs reject
Your DMARC policy tells receiving servers what to do with emails that fail authentication. Here is how the three policies compare:
| Policy | Action on Failure | Protection Level | Best For |
|---|---|---|---|
| p=none | No action; delivers normally | Monitoring only (no protection) | Initial setup & report analysis |
| p=quarantine | Sends to spam/junk | Partial (suspicious emails filtered) | Transition period before reject |
| p=reject | Blocks completely | Full protection against spoofing | Production (after fixing alignment) |
The recommended progression is: none (2-4 weeks) → quarantine (2-4 weeks) → reject. Never skip straight to reject without analyzing your reports first.
How to Set Up DMARC Step-by-Step
Follow these steps to implement DMARC on your domain. Before starting, make sure you have SPF and DKIM already configured for your domain.
Step 1: Verify SPF and DKIM
Use a tool like Vysiro's free scanner to confirm that your domain has valid SPF and DKIM records. DMARC depends on at least one of these being in place.
Step 2: Create Your DMARC Record
Start with a monitoring-only policy. Create a TXT record at _dmarc.yourdomain.com with this value:
Replace "yourdomain.com" with your actual domain and use a mailbox you monitor. The fo=1 tag generates failure reports for every failed message, giving you maximum visibility.
Step 3: Publish the DNS Record
Log into your DNS provider (Cloudflare, Route 53, GoDaddy, etc.) and add the TXT record:
| Type | Name/Host | Value | TTL |
|---|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1 | 3600 |
Step 4: Monitor Reports for 2-4 Weeks
With p=none, no emails are blocked. Receiving servers will start sending you aggregate reports (XML files) showing which IPs are sending email from your domain and whether those messages pass SPF and DKIM. Review these reports to identify legitimate senders that are failing alignment.
Step 5: Fix Alignment Issues
Common issues include third-party services (email marketing platforms, CRMs, ticketing systems) that send on your behalf but are not properly aligned. For each one, you need to either add them to your SPF record or configure DKIM signing with your domain.
Step 6: Tighten the Policy
Once your legitimate email sources are passing, upgrade your policy in stages:
Use the pct tag to gradually roll out enforcement. Start with pct=25 (25% of failing emails quarantined), monitor for a week, then increase to 50, 75, and finally 100.
5 Common DMARC Mistakes
1. Jumping straight to p=reject
Without analyzing reports first, you risk blocking legitimate emails from services like Mailchimp, Salesforce, or Zendesk that send on your behalf. Always start with p=none.
2. Forgetting the rua tag
Without rua, you get no aggregate reports. You are flying blind with no visibility into who is sending email from your domain. Always include a reporting address.
3. Not configuring subdomains
By default, subdomains inherit the parent domain's DMARC policy. But if you have subdomains sending email (e.g., marketing.yourdomain.com), they need proper SPF/DKIM alignment too.
4. Ignoring third-party senders
SaaS tools, CRMs, and marketing platforms often send email on your behalf. Each one needs to be added to your SPF record or configured with DKIM signing using your domain.
5. Setting it and forgetting it
DMARC is not a one-time setup. New email services, infrastructure changes, and misconfigurations require ongoing monitoring. Review reports at least monthly.
How Vysiro Makes DMARC Easy
Vysiro is a trust infrastructure platform that goes beyond simple DMARC monitoring. When you scan your domain, Vysiro checks DMARC along with 12 other security categories — SPF, DKIM, SSL/TLS, DNSSEC, CAA, MTA-STS, BIMI, and more — and provides a unified TrustScore from 0 to 1000.
What makes Vysiro different is the guided fix engine. Instead of just telling you what is wrong, Vysiro can detect, plan, and apply DNS fixes automatically — with a preview before any changes go live. Connect your DNS provider (Cloudflare, Route 53, and more) and fix issues in one click.
Check your DMARC record for free
Get a full DMARC analysis with fix recommendations in seconds. No signup required.
Check DMARC RecordFrequently Asked Questions
What does DMARC stand for?+
Is DMARC required?+
Does DMARC stop all phishing?+
How long does it take to set up DMARC?+
What is the difference between DMARC none, quarantine, and reject?+
Do I need SPF and DKIM before setting up DMARC?+
How do I read DMARC reports?+
Can DMARC break my email delivery?+
Secure Your Domain Today
Scan your domain for free. Get a TrustScore across 30 security categories in under 60 seconds.