DMARC Fundamentals

DMARC, SPF and DKIM — how email authentication actually works.

• What is DMARC?DMARC stops criminals from sending email as your domain. Learn how it works with SPF and DKIM, what a record looks like, and how to roll it out safely.
• What is SPF?SPF lets receivers check which servers may send email for your domain. Learn record syntax, the 10-lookup limit and why SPF alone can't stop spoofing.
• What is DKIM?DKIM puts a tamper-evident cryptographic seal on your email. Learn how selectors work, where the public key lives in DNS, and why DKIM survives forwarding.
• DMARC alignment explainedPassing SPF or DKIM is not enough — the passing domain must match the visible From. Learn relaxed vs strict alignment and how DMARC decides pass or fail.
• DMARC policy: none, quarantine, rejectp=none, p=quarantine and p=reject form a ladder. Learn what each policy makes receivers do — and how to reach full enforcement without losing real mail.
• RUA vs RUF: DMARC report typesDMARC offers two report types — aggregate (rua) summaries and forensic (ruf) copies. Learn what each contains and which one deserves your attention.
• How to read a DMARC reportWalk through a real DMARC aggregate report element by element — and learn to tell a spoofing attempt from a misconfigured legitimate sender.
• Google & Yahoo DMARC requirementsSince 2024, Gmail and Yahoo require DMARC, alignment and one-click unsubscribe from bulk senders. See the full checklist — and what happens if you skip it.
• DMARC record tags explainedEvery DMARC tag explained — v, p, sp, pct, rua, ruf, adkim, aspf and fo — with defaults, examples and three ready-to-adapt records.
• SPF record syntax explainedEvery SPF mechanism and qualifier, what each one actually authorises, and the syntax mistakes that silently break a record — with worked examples.
• SPF, DKIM and DMARC — how they fit togetherThree standards, three different jobs. What each one checks, what none of them can do alone, and the order to deploy them in without breaking mail.
• What is a DKIM selector?A selector is the label that tells receivers which DKIM key to fetch. How to find yours, why every sender needs its own, and what breaks when one is missing.