DMARC

The policy layer that turns SPF and DKIM from checks into consequences.

DMARC (RFC 7489) is a DNS policy that tells receiving servers what to do with mail that uses your domain in the From address but fails authentication. A message passes DMARC when SPF or DKIM passes and the passing identity aligns with the visible From domain.

Why it matters

SPF and DKIM verify technical identities a normal person never sees. DMARC ties them to the From line a human reads, which is the thing phishers actually forge. It is also the only one of the three that reports back to you: receivers send aggregate reports showing who is sending as your domain and whether that mail authenticates. Gmail and Yahoo require at least a p=none record from bulk senders.

In practice

The record lives at a fixed subdomain:

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

p= is the policy for failing mail: none (deliver, just report), quarantine (spam folder), or reject (refuse outright). rua= is where receivers send daily aggregate XML reports. The standard path is to start at p=none, read reports until every legitimate source authenticates, then ramp to quarantine and finally reject. Jumping straight to reject while a forgotten CRM still sends unsigned mail is how companies silently lose their own email.

How Email Fast handles it

Email Fast configures your DMARC record at domain setup and ingests the rua aggregate reports automatically, so per-source pass/fail shows up in the dashboard and you ramp to enforcement on data instead of hope.