/ Glossary — Authentication
What is DMARC?
The policy that ties SPF and DKIM together and tells receivers what to do with mail that fails both. The layer that turns authentication from advisory into enforced. Here's how it works.
/ Definition
DMARC, or Domain-based Message Authentication, Reporting and Conformance, is the policy layer that sits on top of SPF and DKIM. It does two things: it tells receiving servers what to do with mail from your domain that fails authentication, and it asks them to send you reports about what they see. It's the layer that turns authentication from a passive check into an enforced policy.
DMARC requires alignment, not just a pass — the authenticating domain must match your visible From address — which is what makes it effective against the exact-domain spoofing that SPF and DKIM alone don't stop. Since the major providers now enforce DMARC for bulk senders, it's effectively mandatory. Check any domain's DMARC record with our DMARC checker.
/ In practice
The three policy levels
DMARC has three policy levels set by the p= tag. p=none is monitoring only: it collects reports without affecting delivery, which is the right place to start but the wrong place to stay, because it protects nothing. p=quarantine tells receivers to send failing mail to spam. p=reject tells them to refuse it outright — full protection against spoofing of your domain. The standard path is to start at none, use the reports to confirm every legitimate source is aligned, then advance to quarantine and finally reject.
Why the reports matter
The reporting half of DMARC is what makes safe enforcement possible. With a rua address in your record, receivers send daily aggregate reports listing every source sending as your domain and whether each passed. These reports are how you discover the legitimate sending sources you forgot about — a CRM, a support tool, an invoicing system — before you move to enforcement and accidentally block them. Moving to p=reject without first reading the reports is how senders break their own mail, which is why monitoring is inseparable from DMARC done properly. DMARC at enforcement is also the prerequisite for BIMI.
/ Subdomains and rollout
The sp tag for subdomains
DMARC lets you set a separate policy for subdomains using the sp tag. Your p tag covers the organizational domain; sp covers everything beneath it. This matters because attackers often spoof subdomains that were never used for mail — invoices.yourdomain.com, for instance — assuming they're unprotected. Without an explicit sp, subdomains inherit the main policy, which is usually what you want; but setting sp=reject explicitly closes the subdomain-spoofing gap deliberately. A complete DMARC posture considers both the domain and the subdomains beneath it, which our DMARC checker surfaces.
Percentage rollout and report types
DMARC supports a gradual rollout through the pct tag, which applies your policy to only a percentage of mail — pct=10 with p=quarantine means a tenth of failing mail is quarantined while the rest passes, letting you watch the effect before going to 100%. It's a way to de-risk the move to enforcement. DMARC also defines two report types: aggregate reports (rua), the daily summaries that show every source sending as your domain, and forensic reports (ruf), which provide detail on individual failures but are far less widely supported. The alignment data in aggregate reports is what guides a safe path to p=reject. In practice, the percentage and subdomain controls are used together during a careful rollout: a sender might start with pct=10 at quarantine on the main domain while watching subdomain traffic in the reports, then raise the percentage as confidence grows. The reports remain the ground truth throughout, because they show whether the legitimate sources are aligning before any failing mail is actually rejected. This is why senders who rush straight to enforcement so often regret it, and why the patient, report-driven path is the one that reaches BIMI-eligible enforcement without collateral damage to legitimate mail.
Moving to p=reject safely is the hard part. We get you there without breaking mail.
We read your DMARC reports, confirm every legitimate source is aligned, and move you to enforcement cleanly. Bring us your domain and we'll map the path to p=reject.
Book infrastructure reviewRelated capabilities