DMARCEmail authentication explained

What is DMARC?

DMARC is a TXT record at _dmarc.<domain> that tells receiving servers what to do with mail whose From domain is not backed by a passing, aligned SPF or DKIM result: deliver it (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also names an address for daily aggregate reports, which show every server sending as your domain.

How it looks in DNS

TXT

Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r

Failing mail goes to spam, daily aggregate reports go to dmarc@example.com, and subdomains of example.com count as aligned

Part by part

The DMARC record taken apart

The example above, left to right. Every part is something a receiving server reads.

TXT at _dmarc

v=DMARC1p=quarantinerua=mailto:dmarc@example.comadkim=raspf=r

v=DMARC1Version. Must be the first tag, exactly as written
p=quarantineThe policy for mail that fails: none (only report), quarantine (spam folder) or reject (refuse at the door)
rua=mailto:dmarc@example.comWhere receivers send aggregate reports: XML files listing every source IP that sent as the domain and its SPF and DKIM results
adkim=rDKIM alignment: relaxed (r, the default) accepts a d= on the same organizational domain, strict (s) needs the exact name
aspf=rSPF alignment, same rule for the Return-Path domain. Keep r when a provider uses a bounce subdomain such as pm-bounces

Look up the DMARC record of any domain

The same check as our DMARC checker: the record is read live from DNS in your browser and every part is explained. Try your own domain, or a big sender to see a working record.

Try

Reads the TXT record at _dmarc.<domain> (or the parent domain's record for a subdomain) and every report address in it. Lookups go from your browser to Cloudflare's public DNS resolver.

Where your policy sits: none, quarantine or reject
Every tag explained for your record
Report addresses and whether they can receive reports
The corrected record and the next-step record

How it works

How a receiver applies DMARC

Find the policysource (opens the vendor's page in a new tab)
The receiver takes the domain of the visible From address and looks up TXT at _dmarc.<domain>, then at the organizational domain if there is none
Check SPF and DKIMsource (opens the vendor's page in a new tab)
It runs SPF on the Return-Path and verifies the DKIM signatures as usual
Check alignmentsource (opens the vendor's page in a new tab)
DMARC passes when at least one of them passes for a domain aligned with From: the same organizational domain (relaxed) or the exact domain (strict)
Apply the policysource (opens the vendor's page in a new tab)
Mail that fails is delivered, quarantined or rejected as p= (or sp= for subdomains) asks; the receiver may still use its own judgement
Reportsource (opens the vendor's page in a new tab)
Once a day the receiver sends an aggregate report in XML, usually gzip-compressed, to every rua address

DMARC is what connects SPF and DKIM to the address a person sees. Without it, a forger can pass SPF on their own domain and still put yours in the From line. With p=reject, mail that cannot prove it came from you is refused.

Start at p=none with a rua address you actually read, and look at the reports for two to four weeks: every legitimate service (your mailbox provider, CRM, help desk, newsletter tool) should show up passing. Fix the ones that fail by turning on their custom DKIM or return path, then move to p=quarantine and to p=reject. The DMARC record generator writes the record for each step.

Many domains never leave the first step. In our October 2026 check of 2,969 B2B domains, 82% had a DMARC record, but 54% of those records were p=none, so only about 35% of the domains asked receivers to quarantine or reject failing mail (the data).

Reference

DMARC tags, with the RFC 9989 changes

vValues:DMARC1Version; required and first
pValues:none, quarantine, rejectPolicy for the domain. RFC 9989 makes it recommended; a record without p is read as p=none
spValues:none, quarantine, rejectPolicy for subdomains; defaults to p
npValues:none, quarantine, rejectNew in RFC 9989: policy for subdomains that do not exist, a common spoofing target
ruaValues:mailto: addressesWhere aggregate reports go; a third-party address must authorize it with a _report._dmarc record
rufValues:mailto: addressesWhere failure reports with samples go; few large receivers send them
adkim / aspfValues:r (default), sRelaxed or strict alignment for DKIM and SPF
foValues:0 (default), 1, d, sWhen to send failure reports
tValues:y, n (default)New in RFC 9989: test mode, which asks receivers to apply one policy level lower
psdValues:y, n, uNew in RFC 9989: marks a public suffix domain's record; ordinary domains leave it out
pct, rf, riValues:RemovedDropped by RFC 9989; pct still works at receivers that follow RFC 7489, and t= replaces its main use

Sourcesource (opens the vendor's page in a new tab)

Rules and limits

What receivers enforce on DMARC

DMARCbis is published as RFC 9989 on the standards track and obsoletes RFC 7489 and RFC 9091source (opens the vendor's page in a new tab)
RFC 9989 finds the organizational domain by walking up the DNS tree instead of the Public Suffix Listsource (opens the vendor's page in a new tab)
A report address on another domain is used only if that domain publishes v=DMARC1 at <yourdomain>._report._dmarc.<theirdomain>source (opens the vendor's page in a new tab)
Gmail: senders of 5,000+ messages a day need SPF, DKIM and a DMARC record (p=none is enough), with the From domain aligned, one-click unsubscribe and a spam rate under 0.3%source (opens the vendor's page in a new tab)
Yahoo: bulk senders need SPF, DKIM and DMARC of at least p=none that passes, and must honour unsubscribes within 2 dayssource (opens the vendor's page in a new tab)
Outlook.com, Hotmail and Live: domains sending 5,000+ messages a day must pass SPF, DKIM and DMARC (at least p=none) since May 5, 2025source (opens the vendor's page in a new tab)

By provider

The DMARC record for each sending service

The values from each provider's own docs. Open a provider for the full records, the steps in its interface and a check pre-set for it.

Where the record goes

What to type in each field of your DNS panel:

Troubleshooting

Common DMARC errors and fixes

DMARC fails although SPF passes
The Return-Path is the provider's domain; set up a custom return path on your domain or rely on aligned DKIMsource (opens the vendor's page in a new tab)
DMARC fails although DKIM passes
The signature's d= is the provider's domain; turn on custom DKIM for your domain in that providersource (opens the vendor's page in a new tab)
Two DMARC records
Receivers ignore DMARC when _dmarc has more than one v=DMARC1 record; merge them into onesource (opens the vendor's page in a new tab)
Reports to an outside address never arrive
The report service must publish the _report._dmarc authorization record for your domainsource (opens the vendor's page in a new tab)
Record at the wrong name
The name is _dmarc (the panel adds your domain); _dmarc.example.com.example.com is a common typosource (opens the vendor's page in a new tab)
Strict alignment breaks a provider
aspf=s or adkim=s rejects subdomain bounce and signing domains; use r unless you know every sender uses the exact domainsource (opens the vendor's page in a new tab)

For cold email

Mailboxes that come with the DNS records done

Outreach2day buys the domains, publishes SPF, DKIM and DMARC, creates the mailboxes and starts warmup, then sends your campaigns from its own sequencer or exports the mailboxes to Instantly or Smartlead.

Create mailboxes Book a call

SPF, DKIM and DMARC set for youOn every domain, checked after setup and kept in place
$2.50 a mailbox a month12-mailbox minimum; warmup and the sending engine included
1,000+ mailboxesA volume price per mailbox, quoted on a call

Questions

What does a DMARC record look like?

A TXT record at _dmarc.<domain>, for example v=DMARC1; p=none; rua=mailto:dmarc@example.com. The v and p tags are the core; rua is how you get the reports that make the policy safe to tighten.

Is p=none enough?

For Gmail's, Yahoo's and Outlook's bulk sender rules, yes: they ask for a DMARC record and p=none qualifies. It protects nothing, though; spoofed mail is still delivered. Treat p=none as the reporting phase and move to quarantine and reject once every sender passes.

What is DMARC alignment?

The check that the domain SPF or DKIM authenticated is the one in the From address. Relaxed alignment accepts any domain under the same organizational domain (mail.example.com for example.com); strict needs the exact name.

What changed with RFC 9989?

DMARC moved to the standards track as RFC 9989 in 2026. It removes pct, rf and ri, adds np (non-existent subdomains), t (test mode) and psd, makes p recommended, and finds the organizational domain with a DNS tree walk. Existing v=DMARC1 records keep working.

Do I need DMARC for cold email?

Yes. Gmail, Yahoo and Outlook require a DMARC record from senders of 5,000+ messages a day, and a cold email setup spread across many domains needs it on each one. Our mailboxes come with SPF, DKIM and DMARC published on every domain.

Sources

The RFCs and the mailbox providers' sender rules, checked Oct 15, 2026. Where a mailbox provider's rules change, its own page is the reference.

Deliverability call

Talk to our deliverability team

Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change. Running 1,000+ mailboxes? We also quote a volume price below every vendor list price in our comparisons, warmup and sending included.

Review your domains, DNS records and current inbox placement
Size the setup: domains, mailboxes per domain and daily volume per mailbox
Plan warmup and the move from your current provider or sequencer
1,000+ mailboxes: a volume price per mailbox for your setup

Free call

See open times in your time zone and book on this page.

Or open the booking page