# DMARC

> DMARC is the DNS policy that tells receivers what to do when SPF and DKIM fail alignment: none, quarantine, or reject, plus aggregate reports back to you.

Canonical: https://emailfast.dev/glossary/dmarc

DMARC ([RFC 7489](https://datatracker.ietf.org/doc/html/rfc7489)) is a DNS policy that tells receiving servers what to do with mail that uses your domain in the From address but fails authentication. A message passes DMARC when [SPF](/glossary/spf) or [DKIM](/glossary/dkim) passes *and* the passing identity aligns with the visible From domain.

## Why it matters

SPF and DKIM verify technical identities a normal person never sees. DMARC ties them to the From line a human reads, which is the thing phishers actually forge. It is also the only one of the three that reports back to you: receivers send aggregate reports showing who is sending as your domain and whether that mail authenticates. Gmail and Yahoo require at least a p=none record from bulk senders.

## In practice

The record lives at a fixed subdomain:

```text
_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
```

`p=` is the policy for failing mail: `none` (deliver, just report), `quarantine` (spam folder), or `reject` (refuse outright). `rua=` is where receivers send daily aggregate XML reports. The standard path is to start at `p=none`, read reports until every legitimate source authenticates, then ramp to `quarantine` and finally `reject`. Jumping straight to `reject` while a forgotten CRM still sends unsigned mail is how companies silently lose their own email.

## How Email Fast handles it

Email Fast configures your DMARC record at domain setup and ingests the rua aggregate reports automatically, so per-source pass/fail shows up in the dashboard and you ramp to enforcement on data instead of hope.

## Is p=none worth publishing?

Yes. It changes nothing about delivery but turns on reporting, satisfies Gmail's and Yahoo's minimum requirement for bulk senders, and is the necessary first step before enforcement.

## What does alignment mean?

The domain that passed SPF or DKIM must match the From-address domain: exactly, in strict mode, or sharing the registered domain in relaxed mode. Without alignment, a pass on some unrelated domain proves nothing about the From line the reader sees.