Why SPF and DKIM alone aren't enough
You might have SPF and DKIM set up perfectly — but without DMARC, receiving mail servers don't know what you want them to do when those checks fail. They'll often deliver the suspicious email anyway, just marking it as slightly less trustworthy.
DMARC closes that gap. It's the instruction manual that says: "If an email claiming to be from my domain doesn't pass SPF or DKIM, here's exactly what I want you to do with it."
The three DMARC policies
You choose one of three policies when you set up DMARC:
p=none — Monitor only
Receiving servers take no action on emails that fail. They deliver them normally. The only benefit is that you receive reports showing who is sending email as your domain. This is useful when you're first setting up DMARC and want to understand your email traffic before enforcing anything.
p=quarantine — Send to spam
Emails that fail DMARC checks are sent to the recipient's spam or junk folder instead of the inbox. This is a good middle ground — failing emails don't reach the inbox, but they're not deleted outright so you can catch false positives.
p=reject — Block entirely
Failing emails are rejected at the server level — they never reach the recipient at all. This is the strongest protection and what most security experts recommend once you're confident your legitimate email is all passing.
What a DMARC record looks like
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com- v=DMARC1 — this is a DMARC record
- p=reject — the policy (none / quarantine / reject)
- rua=mailto:... — where to send aggregate reports (optional but highly recommended)
Add this as a TXT record at _dmarc.yourdomain.com in your DNS.
DMARC reports — what are they?
When you add a rua= email address, receiving mail servers send you daily XML reports showing every email that claimed to be from your domain, whether it passed or failed, and which server sent it.
These reports are invaluable for spotting email services you forgot to include in your SPF record, or someone attempting to spoof your domain. Most people use a free tool like DMARC Digests or Postmark's DMARC service to turn these XML reports into readable summaries.
The right path to DMARC
Don't jump straight to p=reject. The recommended approach:
- Week 1–2: Set
p=nonewith arua=address. Read the reports. - Once you understand your traffic: Move to
p=quarantine. - After a few weeks with no legitimate mail in spam: Upgrade to
p=reject.
Jumping to p=reject without reading reports first can block legitimate email from a service you forgot to add to SPF.
Who sends spoofed email and why does it matter?
Without DMARC enforcement, anyone can send an email that looks exactly like it came from your domain. This is used for:
- Phishing attacks targeting your customers ("Your account has been locked — click here")
- Business email compromise — impersonating your CEO to request wire transfers
- Spam campaigns that damage your domain's sending reputation
A p=reject DMARC policy makes all of this significantly harder, because spoofed emails simply never arrive.