What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but does not pass an aligned SPF or DKIM check. It also asks receivers to send you reports about that mail. The standard is RFC 7489.

Why it matters

Anyone can type your domain into the From line of an email. SPF and DKIM each prove something about a message, but neither one ties the proof to the address people actually see. DMARC makes that link, publishes your instruction for failures, and gives you reports that show who is sending mail as your domain. That makes spoofing harder and helps you find forgotten senders. It does not decide whether a message reaches the inbox.

How to do it

List every system that sends email as your domain: your mailbox provider, your website's contact form, newsletter tools, invoicing software and support desks.
Check that each one passes SPF or DKIM using a domain that lines up with your From address. Set up SPF and DKIM first if they are missing.
Create one TXT record at the name _dmarc under your domain. A safe first record only monitors:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Read the aggregate reports that arrive at the rua address for a few weeks. Each report lists the sending IP addresses and whether their mail passed.
Fix any legitimate sender that fails, then tighten the policy step by step to quarantine and later reject. The steps are covered in Set Up DMARC: From p=none to Quarantine and Reject.

Crawvix's scan checks "DMARC record is published" and "DMARC policy is enforced and reports are sent" for your domain.

Common mistakes

Jumping straight to p=reject before listing every sender, which can block your own invoices or newsletters.
Publishing two DMARC records. Receivers can ignore the record when more than one exists, so keep exactly one.
Putting the record at example.com instead of _dmarc.example.com.
Writing the report address without mailto:, so no reports arrive.
Leaving p=none in place for years. It is monitoring only and does not ask receivers to act on failures.

Frequently asked questions

Do I need SPF and DKIM before DMARC?

Yes, in practice. DMARC passes only when SPF or DKIM passes and the passing domain lines up with the From domain, so at least one of them has to be working first.

Does DMARC stop all spam?

No. It only addresses messages that claim to be from your own domain. Spam from other domains is outside its scope.

Is DMARC required?

It is not required by law, but Google and Yahoo ask bulk senders to publish a DMARC record. See what Google and Yahoo require from bulk email senders.

Want to see how your own domain looks? Try the free website sample.