DMARC
What is DMARC?
DMARC is a DNS TXT record that tells receiving mail servers what to do when a message fails SPF and DKIM -- monitor, quarantine or reject -- and reports results back to the domain owner. AdminKit's DMARC check tool shows a domain's current policy and whether its alignment is set up correctly.
By AdminKit team, Netbase JSC · Updated
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that builds on SPF and DKIM by telling receiving mail servers what policy to apply when a message fails both checks — p=none (monitor only), p=quarantine (send to spam), or p=reject (refuse outright) — and where to send a DMARC aggregate report (RUA) summarizing authentication results across all senders using the domain. DMARC also requires “alignment”: the domain in SPF or DKIM must match the domain the recipient sees in the From header, closing a gap where a message could pass SPF or DKIM for an unrelated domain. DMARC is defined in RFC 9989, a Proposed Standard published in May 2026 whose document record is tracked at the IETF Datatracker; it obsoletes the original 2015 specification, RFC 7489, and moves aggregate and failure reporting into RFC 9990 and RFC 9991. dmarc.org, the standard’s own reference site, has a plain-language overview of the policy and reporting model. Microsoft’s DMARC setup guide for Microsoft 365 recommends rolling a policy out gradually: start with p=none on a low-volume domain or subdomain, use the aggregate and forensic reports to see which legitimate mail passes or fails, and only then raise the policy to p=quarantine.
Frequently asked questions
What do DMARC's three policy options actually do?
p=none only monitors and reports without affecting delivery, p=quarantine sends failing mail to spam, and p=reject refuses it outright.
What does DMARC "alignment" mean?
It means the domain authenticated by SPF or DKIM must match the domain the recipient sees in the From header, closing a gap where a message could pass SPF or DKIM for an unrelated domain.
What is a DMARC aggregate report (RUA)?
It's a report DMARC's DNS record can request, summarizing authentication results across all senders using the domain, sent back to the domain owner.
Can a message pass DMARC if it fails SPF but passes DKIM?
Yes -- DMARC treats a message as authenticated if it passes either SPF or DKIM with alignment, so passing just one of the two aligned checks is enough; the policy on this page applies only when both fail.