Guide
What is DMARC?
DMARC protects your domain from spoofing and phishing: it tells receiving mail servers how to handle email that pretends to be your domain. This guide explains how it works — and how to enforce it safely.
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on two existing techniques — SPF and DKIM — and adds two things: a policy (what should a recipient do with suspicious mail?) and reporting (who is sending in your name?). Without DMARC, anyone can send email that looks like it comes from your domain.
The three DNS records
Email authentication runs on three TXT records in your DNS. DMARC ties the first two together.
A list in your DNS of the mail servers allowed to send for your domain. The recipient checks whether the sending server is on the list.
A cryptographic signature in the email header. The recipient verifies it with a public key in your DNS — proof the mail wasn’t altered in transit.
Tells recipients what to do when neither SPF nor DKIM aligns with your visible sender, and where to send reports (rua). So you see exactly who mails in your name.
How DMARC works: the policy ladder
DMARC evaluates whether SPF or DKIM “aligns” with the domain the recipient sees in the From line. If it fails, your policy decides the outcome. You climb in three steps — never straight to reject.
Monitoring mode. Nothing is blocked; you collect reports to see who sends in your name. The safe starting point.
Suspicious mail lands in spam/quarantine. Only enable this once all your legitimate sources align reliably.
Suspicious mail is fully rejected. Full protection — the end goal, as long as no legitimate source still fails.
Why “94% pass” tells you nothing
Most tools show a single percentage. But a domain at “94%” can be safe or dangerous: that failing 6% is either spoofing you want to block, or a legitimate sender without DKIM that p=reject would break. Same number, opposite advice.
The only correct approach is to reason per sending source: each source gets its own status (approved, pending, blocked). You’re ready to tighten only when every approved source aligns reliably — never based on a total.
That’s exactly what DMARC-IT does: it classifies each source and tells you precisely when it’s safe to take the next step, with the blockers to fix first.
Frequently asked questions
Do I need SPF and DKIM for DMARC?
Yes. DMARC builds on them: an email passes if SPF or DKIM aligns with your visible sender. Without at least one correctly configured mechanism, no email can pass.
Is p=none already safe?
p=none blocks nothing — it’s monitoring. It doesn’t protect you from spoofing yet, but it’s the necessary first step to see who sends in your name before you tighten.
Can DMARC block legitimate email?
At p=quarantine or p=reject, yes, if a legitimate source doesn’t align (e.g. a newsletter service without DKIM). That’s why you tighten per source and only when everything checks out.
What’s the difference between RUA and RUF?
RUA are the aggregate reports (a daily summary per source) — the ones you use. RUF are per-message forensic reports; most large providers no longer send them and they can contain PII.
How long does it take to reach p=reject?
Depending on your number of sources, usually a few weeks. You need a data window of at least 7 days and all approved sources aligning ≥98%. DMARC-IT tracks this for you.
Enforce DMARC on reject, safely.
DMARC-IT reads every source separately and guides you step by step from monitoring to full protection.