What it is
DMARC sits on top of SPF and DKIM. It does two jobs: it tells receivers what to do with mail that fails authentication, and it asks them to send you reports about what they saw. It lives at _dmarc.yourdomain.com as a TXT record.
A working record: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
The three policies
p=none enforces nothing. It monitors and reports, which is the correct place to start and the wrong place to stop. Plenty of domains have sat on p=none for years while their owners believed they were protected.
p=quarantine sends failing mail to spam. p=reject refuses it outright. Reject is the goal, and you get there by reading reports at none until you are confident every legitimate sender passes.
What changed in 2026
DMARC was rewritten in May 2026. RFC 9989 replaced RFC 7489, and three things moved: the pct tag is gone, np (non-existent subdomain policy) and t (testing) are new, and the Public Suffix List is no longer used for organisational domain discovery. Records written before that are not automatically broken, but several once-common patterns in them now are.
Is it mandatory?
For bulk senders to Google, Yahoo and Microsoft, effectively yes — a DMARC record is required and p=none technically satisfies it. For cold email you want to go further, because the point is protecting the domain rather than passing a check.
Check yours
These run free in your browser. Nothing you type reaches a server.
Common questions
Can I go straight to p=reject?
You can, and you may silently kill legitimate mail from a service you forgot about. Start at none, read the aggregate reports for a few weeks, fix what is failing, then move up through quarantine.
What are rua and ruf?
rua receives aggregate reports — daily XML summaries of what receivers saw, and the useful one. ruf receives forensic reports on individual failures, which most large receivers no longer send for privacy reasons.
Why is my mail failing DMARC when SPF and DKIM pass?
Alignment. DMARC requires that the domain SPF or DKIM passed for matches the domain in the visible From header. Both can pass without either aligning.
Related concepts
Everything above is diagnosis. To confirm a fix worked you need placement data — seed accounts across the major providers, plus the DMARC aggregate reports read as a trend rather than a wall of XML. GlockApps is what I run for both.
See GlockApps →Affiliate link — it costs you nothing and help keep these tools free. Everything I use →If this is the thing going wrong
The pages explain it. If you would rather it was simply fixed, that is the work I do.