DMARC Explained: How It Stops Email Spoofing

What DMARC Actually Does

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers two things: how to treat email claiming to be from your domain if it fails authentication checks, and where to send reports about those checks. It’s the enforcement layer that sits on top of SPF and DKIM – on its own it authenticates nothing, but it’s what turns “this email looks a bit off” into “reject this email outright.”

Without DMARC, SPF and DKIM are advisory. A receiving server can see a message failed SPF and still deliver it to the inbox, because nothing told it not to. DMARC closes that gap by publishing a policy the receiver is expected to honour.

A Basic DMARC Record

DMARC lives in a TXT record at _dmarc.yourdomain.com:

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Breaking that down:

• v=DMARC1 – the version tag, always this exact value.
• p=quarantine – the policy. Options are none (monitor only, take no action), quarantine (send failing mail to spam), or reject (bounce it outright).
• rua – the address that receives aggregate reports: daily digests showing who’s sending mail as your domain and whether it passed authentication.

A Fuller Example

_dmarc.example.com. TXT "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-forensic@example.com; adkim=s; aspf=s"

• sp=reject – policy for subdomains, set separately from the main domain policy.
• pct=100 – apply the policy to 100% of mail that fails. Useful to set lower (e.g. pct=10) while rolling out DMARC gradually.
• ruf – forensic reports, giving per-message failure detail (many providers no longer send these due to privacy concerns).
• adkim=s / aspf=s – strict alignment mode, requiring the domain in the DKIM signature or SPF check to exactly match the visible From address, rather than just sharing an organisational domain.

How Alignment Works

DMARC doesn’t just check that SPF or DKIM passed – it checks that the domain that passed matches the domain in the message’s visible “From” header. This is the part that actually stops spoofing: an attacker could easily get SPF to pass for their own domain, but they can’t make it pass for yours while still showing your domain in the From field.

A Sensible Rollout Path

1. Start with p=none and an rua address. This collects reports without affecting delivery, so you can see everywhere your domain sends mail from – including systems you’d forgotten about, like a marketing platform or a helpdesk tool.
2. Once the reports look clean, move to p=quarantine; pct=25 and increase the percentage over a few weeks.
3. Finish at p=reject; pct=100 once you’re confident nothing legitimate is failing.

Skipping straight to reject is the classic mistake – it’s very effective at blocking spoofed mail, and equally effective at silently bouncing your own newsletter if you forgot to add it to your SPF record.

Next in this series: SPF, the record DMARC leans on to check whether a sending server is authorised at all.