Why DMARC matters now
SPF and DKIM prove a server may send for a domain, but not necessarily the domain in the From line. DMARC closes that gap: it passes only if SPF or DKIM passes for the same domain people see.
Since 2024, Gmail and Yahoo require a DMARC record from anyone sending in bulk. Without one, your emails are more likely to be filtered.
What a DMARC record looks like
It's a TXT record on the name _dmarc under your domain:
_dmarc.acme.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@acme.com"The three policies
- p=none: just monitor. Nothing is blocked; you get reports. Start here.
- p=quarantine: emails that fail go to spam.
- p=reject: emails that fail are refused. The strongest protection against people faking your domain.
A safe rollout
- Week 1: publish p=none with a rua= address to receive reports.
- Weeks 2–4: read the reports and make sure every service that sends as you passes SPF or DKIM.
- Then: move to p=quarantine, and later p=reject once nothing legitimate is failing.
Common mistakes
- Two DMARC records. Inboxes ignore both. Keep exactly one.
- Jumping straight to p=reject before checking reports, which can block your own invoices or helpdesk replies.
- Putting the record on the root domain instead of _dmarc.
How to check yours
The free email setup checker reads your live DMARC record, explains your current policy and suggests the next safe step.
Questions
Is p=none good enough?+
It satisfies the Gmail and Yahoo requirement and gives you reports, but it doesn't stop anyone faking your domain. Aim for quarantine or reject.
What are rua reports?+
Daily summaries from inbox providers listing who sent email as your domain and whether it passed. They're XML files; most people use a free report reader.