DMARC explained
What alignment means, how to choose a policy, and how to reach p=reject without blocking your own mail.
In short
- DMARC is the record that finally protects the From address your recipients actually see.
- It requires SPF or DKIM to pass and to align with your From domain.
- Start at p=none, look at the reports, then move to quarantine and reject.
- p=none publishes a policy but blocks nothing, so stopping there protects no one.
What DMARC is
DMARC, Domain-based Message Authentication, Reporting and Conformance (RFC 7489), sits on top of SPF and DKIM and adds the two things they lack: a link to the visible From: address, and a way to tell receivers what to do when authentication fails.
Without DMARC, an attacker can pass SPF with a domain they own while displaying your brand in the From: header. DMARC closes that gap by requiring alignment.
Alignment, the part that matters
Alignment means the domain that authenticated must be related to the domain in the From: header your recipient sees.
- SPF alignment: the domain in the envelope sender (return-path) matches your
From:domain. - DKIM alignment: the
d=domain in the signature matches yourFrom:domain.
Only one of the two needs to pass and align for DMARC to pass. That is why DKIM matters so much: it survives forwarding, so it keeps DMARC passing in cases where SPF cannot.
Alignment has two modes. Relaxed (the default) accepts a subdomain of the same organizational domain, so mail.yourdomain.com aligns with yourdomain.com. Strict requires an exact match. Relaxed is the right choice for almost everyone.
The record
A DMARC record is a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com| Tag | What it does |
|---|---|
p= | The policy: none, quarantine, or reject. |
rua= | Where aggregate reports are sent. |
sp= | A separate policy for subdomains. Defaults to the value of p. |
adkim= / aspf= | Alignment mode, r for relaxed (default) or s for strict. |
pct= | Percentage of failing mail the policy applies to, for staged rollouts. |
How to roll it out
- Publish
p=nonewith anruaaddress. Nothing changes for your mail; you start receiving daily aggregate reports listing who sends as your domain and whether they authenticate. - Read the reports for a few weeks. You are looking for legitimate senders that fail alignment: your invoicing tool, your CRM, a forgotten server. Fix each one.
- Move to
p=quarantine. Failing mail goes to spam rather than being refused, so a mistake at this stage is recoverable. - Move to
p=rejectonce reports show only traffic you recognize passing. This is the setting that actually stops impersonation.
Do not skip step 2. Almost every DMARC disaster starts the same way: someone publishes p=reject before finding out which of their own systems were failing.
In Mailverick
When you add a domain, the portal shows a recommended _dmarc record with v=DMARC1; p=reject. It is optional, not required to start sending, and covered in Getting Started.
If you are new to DMARC, publish p=none with your own rua address first and tighten to the recommended value once you have read a few weeks of reports. Mailverick monitors the record and reports its status alongside SPF and DKIM. Aggregate report parsing inside the portal is not available yet, so point rua at a mailbox or a report analyzer you control.
Common mistakes
Treating p=none as protection. It publishes an opinion and enforces nothing. If you never move past it, you get reports and no defense.
Jumping straight to p=reject. Legitimate mail from systems you forgot about starts bouncing, often invoices or password resets, and you find out from customers.
No rua address. Without reports you are guessing about who sends as your domain, which is the one thing DMARC is unusually good at telling you.
Forgetting subdomains. sp= inherits p by default, which is usually what you want. Publishing p=reject while a subdomain sends unauthenticated mail will block that subdomain too.
Assuming DMARC stops lookalike domains. DMARC only governs your exact domain. yourdomaln.com is a different domain and DMARC has no say over it. That is a brand monitoring problem, not a DMARC one.
Relying on SPF alignment alone. If your return-path is on your provider’s domain, SPF passes without aligning. Either use a custom return-path on your own domain or rely on aligned DKIM, which Mailverick gives you by default.
FAQ
Do SPF and DKIM both need to pass?
No, one aligned pass is enough. In practice DKIM is the one that keeps working when mail is forwarded, so it does most of the work.
Is DMARC required to send email?
Not technically, and Mailverick does not require it. But Gmail and Yahoo require it from bulk senders, and it is the only mechanism that protects your From: address, so treat it as expected rather than optional. See Gmail and Yahoo sender requirements.
What does a DMARC report contain?
Aggregate reports (rua) are daily XML summaries per sending source: how many messages, from which IPs, and whether SPF and DKIM passed and aligned. They contain no message content.
Will DMARC break forwarded mail?
It can, when only SPF authenticates. With aligned DKIM in place, forwarded messages still pass. Mailing lists that rewrite the message are the remaining hard case, and that is what the From: rewriting you see on lists exists to solve.
Should I use pct=?
It is useful for easing into quarantine on a high-volume domain. For most senders the none to quarantine to reject progression is enough on its own.
Last updated: August 2026