What Is DMARC? A Plain-English Guide

How DMARC works, what the policies mean, and why reporting is the part most people ignore - from a contributor to the RFC.

By Henry Timmes · Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)
DMARCEmail AuthenticationRFC 7489RFC 9989
Henry Timmes
Henry Timmes Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)

How DMARC works, what the policies mean, and why reporting is the part most people ignore - from a contributor to the RFC.

This guide is written by Henry Timmes, named as a contributor to RFC 7489 and its successor RFC 9989 - the IETF standards that define DMARC.

What DMARC Is

DMARC - Domain-based Message Authentication, Reporting and Conformance - is the standard that lets a domain owner tell receiving mail servers two things: how to check that a message really came from them, and what to do if that check fails. It builds on SPF and DKIM, adds the concept of alignment, and gives senders reporting so they can finally see who is sending mail in their name.

It was first defined in IETF RFC 7489, developed by a consortium that included Google, Microsoft, Yahoo, PayPal and others, and later updated by RFC 9989. I was named as a contributor to both.

How It Works

When mail arrives, the receiver checks SPF and DKIM. DMARC then asks: does the domain that passed SPF or DKIM align with the domain in the visible From address? If yes, DMARC passes. If neither aligns, DMARC fails, and the receiver applies the policy you published.

The Three Policies

p=none - monitor only; take no action, but send me reports. The starting point.

p=quarantine - send failing mail to spam/junk.

p=reject - refuse failing mail outright. The end goal, and what fully protects your domain from spoofing.

The Part Most People Ignore

DMARC's reporting is its most useful feature and the most overlooked. The rua address receives daily aggregate reports listing every source sending as your domain, whether each passed SPF, DKIM and alignment. This is how you discover the forgotten CRM, the invoicing tool, or the spoofer - before you tighten policy. Learn to read them in how to read a DMARC report.

Why It Matters Now

Gmail, Yahoo and Microsoft now require a published DMARC record for bulk senders. Beyond compliance, DMARC at p=reject is the only thing that stops others from spoofing your exact domain - protecting both your recipients and your reputation.

Frequently Asked Questions

What is DMARC in simple terms?

DMARC is a standard that lets a domain owner tell receiving servers how to verify their mail (via SPF and DKIM alignment) and what to do if it fails - monitor, quarantine, or reject - while sending back reports on who is sending mail as that domain.

What does p=none, p=quarantine and p=reject mean?

p=none monitors only and takes no action; p=quarantine sends failing mail to spam; p=reject refuses it outright. Senders start at none to observe, then tighten to reject once all legitimate sources align.

Who created DMARC?

DMARC was defined in IETF RFC 7489 by a consortium including Google, Microsoft, Yahoo and PayPal, and later updated by RFC 9989. Henry Timmes is named as a contributor to both RFCs.

Is DMARC required?

For bulk senders to Gmail, Yahoo and Microsoft, a published DMARC record is required - at minimum p=none with alignment. It is also the only way to stop exact-domain spoofing.

Emails landing in spam?

Henry Timmes diagnoses why your mail isn't reaching the inbox - Microsoft 365, Gmail, Yahoo and beyond - and maps a practical fix. Book a free 15-minute call, no obligation.

Book a free consultation

Related