DMARC Knowledge Base

DMARC in 60 seconds

Three DNS records decide whether the world's mail systems believe an email is really from you. SPF lists the servers allowed to send for your domain, and receivers check the connecting server against that list. DKIM adds a cryptographic signature to every message, which receivers verify against a public key you publish in DNS. Both prove something useful, but neither looks at the address your recipient actually sees.

DMARC closes that gap. It requires SPF or DKIM to pass for the same domain that appears in the visible From address — that match is called alignment — and then tells receivers what to do when nothing aligns — the three values the p= tag accepts: monitor only (p=none), quarantine or reject. It also asks them to report back on the mail they see claiming to come from your domain, which is what makes a safe rollout possible.

Read What is DMARC? for the full picture, or check what your domain publishes right now with our free DMARC record checker.