What is DMARC

Anyone with a mail server can type your domain into the From line of a message you never sent, and nothing in the mail protocol checks it. DMARC (Domain-based Message Authentication, Reporting and Conformance) is the DNS record that closes that hole. It tells Gmail, Outlook and every other receiver what to do with mail that claims to be from you and can't prove it, and it gets them to report back on who's sending as your domain.

Does publishing DMARC stop email spoofing straight away? No. The record you publish first, p=none, blocks nothing. It starts the reports flowing, and the reports are what get you safely to p=reject, the setting that does block forged mail.

How DMARC works: two checks, one rule

Receivers already run two checks on incoming mail. SPF checks whether the server that connected is on the list your domain publishes in DNS. DKIM checks a signature on the message against a public key in your DNS. Both work. Both share a gap: neither one has to involve the domain in the From line. A message can pass SPF and DKIM for some domain the recipient never sees while the From line shows yours.

DMARC adds one rule on top. A message passes DMARC when at least one of those two checks passes and the domain that passed is the one in the From line. That match is called alignment, and it's the only idea in DMARC you have to actually understand. An invoicing vendor can pass SPF for its own return address and sign as vendor.net while the From line shows your company. Without alignment that counts as authenticated. With it, it fails, and your DMARC policy says what happens next. The alignment guide walks through a real header.

The DMARC record is one line of DNS

You publish it as a TXT record at _dmarc. followed by your domain. This is the record most domains should start with:

v=DMARC1 names the protocol. The other two tags do the work.

Tag	What receivers do
p=none	Deliver failing mail anyway, as if there were no record.
p=quarantine	Put failing mail in the spam folder.
p=reject	Refuse failing mail.
rua=	Send reports to this address, usually one XML file per receiver per day, listing every source that sent mail as your domain.

Publish exactly one record at that name. Two records there make receivers ignore both. Leave out rua= and you still have a policy, but nobody sends you reports, so you're guessing which services send as you. The free DMARC checker reads your live record and flags the tags that leave a gap.

Start at p=none because of the senders you've forgotten

Most domains send mail from more places than anyone remembers: the mailbox provider, a marketing platform, an invoicing tool, a helpdesk, payroll. Some of those fail SPF or DKIM today through nobody's fault. Publish p=reject now and receivers refuse their mail. The bounce goes to the sending platform, not to you, and the customer who never got the invoice doesn't open a ticket. You find out weeks later.

So the work runs in this order.

1. Publish p=none with a rua= address. Reports start within a day or two.
2. Read the reports for a few weeks and list every source that sends as your domain.
3. Fix the senders that are yours. Stop the ones that shouldn't be sending as you.
4. Move to p=quarantine. After a stretch of clean reports, change one word to p=reject.

Quarantine is the halfway house: failing mail goes to spam, where a person can still dig it out. I move the policy when the pass rate holds above 98% for two weeks running. A domain that has never sent mail is the one exception. It has no forgotten senders, so it can go straight to reject. The DMARC setup guide has the numbers I wait for at each step.

Your policy covers your subdomains too, unless you say otherwise. A marketing platform sending from news.example.com falls under the parent's reject. Sort it out before you move the parent, or give the subdomains their own policy with the sp= tag.

What p=reject stops, and what it can't

At reject, a forged invoice sent from your exact domain never reaches a Gmail or Outlook inbox. Receivers that honor the policy refuse it during delivery, and the forger gets the bounce.

Know the edges. A lookalike domain passes its own DMARC, and yours never comes into it. A display name that reads as your CEO over a random mailbox address is untouched, because the From domain isn't yours. A criminal inside a real mailbox at your company sends real, signed mail that passes every check. DMARC authenticates the domain. It can't vouch for the person.

There's a second payoff long before reject. Google bounces unauthenticated bulk mail with 550-5.7.26 and Microsoft returns 550 5.7.515 for the same class of failure, and both check for a published DMARC record. A record at none, with SPF or DKIM passing on your own mail, keeps your invoices out of that bounce.

The reports are XML, and reading them is the whole job

Everything above turns on the reports. Each participating receiver sends one file a day, a few kilobytes of XML covering a 24 hour window, and some of them don't parse cleanly. You can read them by hand. The aggregate report guide goes through a real one field by field, and after about ten files you'll recognize the four patterns: your own mail, a vendor that isn't signed with your domain, forwarding, and spoofing.

Doing that every morning is a different job. Dozens of files a week arrive from receivers you've never heard of, and a payroll sender that runs once a month is invisible until the day it runs. What you're building is a table with one row per sending source: who it is, whether it passes, whether it's yours. That table is what makes the move to reject safe. Most people read files for a week, stop opening the folder, and the domain stays at none.

What we do with the reports

This is the part we built DomainCanary for. You point the rua= tag at us and we parse the XML from every receiver, malformed files included, and keep daily totals per source for the life of the account. One mail arrives on Monday. It opens on your pass rate against last week, lists new sending sources with a pass or fail verdict per IP, and ends on the one change worth acting on. On the Starter plan ($19 a month for 3 domains) and up we also mail you the day a new source fails or a known sender stops passing, at most once a day per domain; on the Business plan ($49 for 10) every domain goes into the same Monday mail. The pricing page has the rest. Your first domain is free, with no card.