Kangarua

What is DMARC?

DMARC (RFC 7489) is the layer that makes SPF and DKIM mean something for the address a recipient actually sees. It requires that at least one of the two passes and aligns with the RFC5322.From domain, and it publishes the disposition a receiver should apply when neither does.

Alignment is the whole mechanism

SPF authenticates the envelope domain, DKIM the d= of the signature. Neither is necessarily the domain in the From header — and the From header is the only one the recipient reads. DMARC passes when an SPF or DKIM pass is aligned with it.

Relaxed alignment (the default, aspf=r / adkim=r) requires the organisational domains to match, so a subdomain counts. Strict (s) requires an exact match. Relaxed is the right default for almost everyone; strict breaks the moment a service signs as a subdomain.

The policy tag

p= carries the request to receivers, and it is the only tag that changes what happens to a message.

The tags you did not set still apply

sp= absent means subdomains inherit p=. pct= absent means the policy applies to 100% of failing mail; a lower value applies it to a sample and delivers the rest, which is a rollout tool and not a safety setting. adkim/aspf absent means relaxed alignment.

The scan at the bottom of this page prints your record tag by tag, including these defaults, because a default you cannot see is a default you cannot check.

Getting to enforcement safely

Publish p=none with a rua= address, collect aggregate reports for two to four weeks, and read them per source. Move up only when aligned volume is at or above 95% and every remaining failure has an explanation — a broken SPF record, or a receiver reporting the message as forwarded, are both benign; an unidentified source at volume is not.

A rua= on a domain other than your own needs authorisation from that domain: <yourdomain>._report._dmarc.<rua-domain> must exist as a TXT record (§7.1), or conforming receivers send nothing at all.

Frequently asked questions

Is p=none worth publishing at all?

Yes, but only as a step. It buys you the aggregate reports, which are the only view you get of who sends as your domain. It provides no protection: a receiver following p=none delivers the forgery and files a report about it.

Can p=reject block my own mail?

Yes, and that is the whole risk. Any legitimate source that does not produce an aligned SPF or DKIM pass is rejected under p=reject. This is why enforcement follows the reports rather than preceding them.

Check your domain

Free, no account. You get a list in plain language.