Skip to content
Back to Blog
DMARC.WS Team··8 min read

What is DMARC? A Complete Guide to Email Authentication

DMARCEmail SecurityGuide

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that protects your domain from being used in email spoofing, phishing, and other cyber attacks.

It builds on two existing protocols — SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) — and adds a critical layer: policy enforcement and reporting.

Why DMARC Matters

Every day, billions of emails are sent impersonating legitimate businesses. Without DMARC:

  • Attackers can send emails that appear to come from your domain
  • Your customers and partners may fall victim to phishing
  • Your domain reputation and deliverability suffer
  • You have zero visibility into who is sending email on your behalf

How DMARC Works

DMARC works by publishing a DNS TXT record at _dmarc.yourdomain.com that tells receiving email servers:

  1. Which authentication methods to check (SPF and/or DKIM)
  2. What to do with failing emails (none, quarantine, or reject)
  3. Where to send reports about email authentication results

The Authentication Flow

Sender → Email Server → Receiving Server
                              ↓
                        Check SPF record
                        Check DKIM signature
                        Check DMARC alignment
                              ↓
                        Apply DMARC policy
                        Send aggregate report

When an email arrives, the receiving server:

  1. Checks if the sending IP is authorized by SPF
  2. Validates the DKIM cryptographic signature
  3. Verifies that SPF or DKIM aligns with the From domain
  4. Applies the DMARC policy if alignment fails

DMARC Record Anatomy

A typical DMARC record looks like this:

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100
Tag Meaning Example
v Version (always DMARC1) v=DMARC1
p Policy for domain none, quarantine, reject
rua Aggregate report destination mailto:reports@example.com
ruf Forensic report destination mailto:forensics@example.com
pct Percentage of emails to apply policy 100
adkim DKIM alignment mode r (relaxed) or s (strict)
aspf SPF alignment mode r (relaxed) or s (strict)

Getting Started with DMARC

The recommended approach is a phased rollout:

  1. Monitor (p=none) — Collect reports without affecting email delivery
  2. Quarantine (p=quarantine) — Send failing emails to spam
  3. Reject (p=reject) — Block failing emails entirely

Start with p=none and use a service like DMARC.WS to analyze your reports before tightening your policy.

Key Takeaways

  • DMARC protects your domain from spoofing and phishing
  • It requires SPF and/or DKIM to be properly configured
  • Start with a monitoring policy and tighten over time
  • Aggregate reports give you visibility into all email senders
  • Every organization with a domain should implement DMARC