DMARC is the email authentication policy that tells receiving servers what to do when a message fails SPF and DKIM. This guide explains the policy options, how alignment works, the _dmarc TXT record, and why it matters for deliverability.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that lets a domain owner publish a policy telling receiving mail servers what to do with messages that fail SPF and DKIM - and request reports on those failures.
DMARC sits on top of SPF and DKIM. A receiving server that supports DMARC:
It checks the message against the domain's SPF record and DKIM signature, recording a pass or fail for each.
It verifies that the domain in the From header matches the domain that passed SPF or DKIM. A message can pass both checks but still fail DMARC if the domain does not align.
If the message fails both authentication and alignment, the server applies the domain's published DMARC policy: none, quarantine, or reject.
It emails aggregate (RUA) and forensic (RUF) reports about the results to the addresses published in the DMARC record.
none
quarantine
reject
Most domains publish p=none first, review the reports for several weeks, then tighten to quarantine and eventually reject once all legitimate senders are aligned.
A DMARC policy lives in a DNS TXT record at the special subdomain _dmarc:
A valid SPF and DKIM setup with a DMARC record at reject is the standard signal that a domain is protected against spoofing - and a positive signal for senders checking it.
When BounceZero checks an address, the domain's DMARC policy is one of the signals it reads. A domain with a strict, aligned policy is far less likely to be part of a spam operation - while a domain with no SPF, no DKIM and no DMARC is a higher-risk sender. It is one input among many, not a verdict on its own.
Check any domain's policy in seconds with the free BounceZero DMARC Checker.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol published as a DNS TXT record. It tells receiving servers what to do with messages that fail SPF and DKIM checks, and asks for reports about authentication failures so domain owners can monitor spoofing.
Alignment requires the domain in the visible From header to match the domain that passed SPF or DKIM. If they differ, the message is considered not aligned. DMARC lets you require either strict (exact match) or relaxed (subdomain allowed) alignment.
none sends messages to the inbox but generates reports (monitor mode); quarantine instructs the receiving server to send unauthenticated mail to spam; reject instructs it to refuse the message entirely. Most domains start at none, then move to quarantine and reject as legitimate senders are confirmed.
Query the _dmarc TXT record: `dig TXT _dmarc.example.com` or use a free DMARC checker. BounceZero's DMARC Checker shows a domain's policy, alignment requirements, and whether it will reject unauthenticated mail.
DNS intelligence, SMTP probes and ML scoring in one pipeline. 100 free verifications.
Start FreeFollow BounceZero