DMARC for Email: What It Is and How to Audit It
October 1, 2026
You have set up SPF. You have set up DKIM. But what should a receiving server do when an email claiming to be from your domain fails both checks? Without DMARC, you leave that decision entirely to someone else.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy that tells receiving servers how to handle emails that fail authentication, and it sends you reports on who is using your domain to send email.
It is the layer that turns SPF and DKIM into real protection. If an analytics platform such as Email Audit Engine flags falling deliverability on your Mailchimp campaigns, an authentication gap is one of the first causes to rule out.
DMARC also rewards a methodical approach. Publishing the record takes minutes, but reaching full protection without blocking your own campaigns takes a plan. That plan is what most of this guide is about.
What Is DMARC in Email?
DMARC is a short record that sits in your domain's DNS at _dmarc.yourdomain.com. It does two jobs. It sets a policy for emails that fail authentication, and it asks receiving servers to send you reports about the emails they see from your domain.
The main problem it solves is spoofing of your visible "From" address. SPF and DKIM each check part of the picture, but neither tells a receiving server what to do when a check fails. DMARC fills that gap and connects both checks to the address your subscribers see.
DMARC has also moved from best practice to requirement for many senders. Since 2024, some of the largest mailbox providers have required bulk senders to publish a DMARC record.
Getting it right protects your brand and keeps your campaigns reaching the inbox at those providers, which makes it part of the groundwork for email marketing success.
How Does DMARC Work With SPF and DKIM?
DMARC does not check emails on its own. Instead, it looks at the results of SPF and DKIM and adds one extra test called alignment.
An email passes DMARC when at least one of those checks passes, and the domain it checked matches the domain in the "From" address.
Here is a simple example. Say you send from [email protected], and your email is signed with DKIM using d=yourbrand.com. DKIM passes, the domains match, and the email passes DMARC.
Now imagine the same email is signed only with your email platform's own domain. DKIM may still pass, but the signing domain no longer matches yourbrand.com, so DMARC fails. This is why emails can pass SPF and DKIM yet still fail DMARC.
Alignment comes in two modes. Relaxed alignment, the default, accepts a match at the organizational level, so mail.yourbrand.com counts as matching yourbrand.com. Strict alignment requires an exact match.
What Does a DMARC Record Look Like?
A DMARC record is shorter than most people expect. It is a single line of tags separated by semicolons, and a working record needs only a few of them. Here is a generic example:
v=DMARC1; p=none; rua=mailto:[email protected]
The v=DMARC1 tag identifies the record and must come first. The p= tag sets your policy, which we cover in the next section. The rua= tag tells receiving servers where to send aggregate reports, and while it is technically optional, a DMARC record without it leaves you flying blind.
You may also see a few optional tags. The ruf= tag requests failure reports, and sp= sets a separate policy for subdomains. The adkim= and aspf= tags switch DKIM or SPF alignment between relaxed (r) and strict (s).
As with SPF, a domain should have only one DMARC record. If two exist, receiving servers may ignore both. Check for duplicates any time someone new has access to your DNS settings.
What Do the DMARC Policies Mean?
The policy is the heart of your DMARC record. It tells receiving servers what to do with emails that fail, and there are three options. Each one is a step up in protection.
A p=none policy is monitor-only. Failing emails are delivered as normal, but you receive reports showing who is sending email as your domain. It is the right starting point because it lets you find and fix legitimate senders before anything gets blocked.
A p=quarantine policy asks receivers to treat failing emails as suspicious, which usually means sending them to spam. A p=reject policy asks receivers to block failing emails outright. Reject gives the strongest protection against spoofing, but it is also the least forgiving if a legitimate service is misconfigured.
The common mistake is starting at p=none and never moving on. That gives you useful reports but no real protection. The goal is to reach quarantine or reject once your reports show that all your genuine email is passing.
How Do You Audit Your DMARC Record?
A DMARC audit checks whether your record exists, is correct, and is doing its job. It is a short, repeatable process, and it fits naturally inside a wider email deliverability audit. Work through these checks in order:
- Confirm the record exists. Use a free online DMARC lookup tool or run dig TXT _dmarc.yourdomain.com from a command line.
- Check there is only one record. Remove or merge any duplicates.
- Validate the syntax. Make sure v=DMARC1 comes first, and every tag is spelled correctly.
- Review the policy level. Note whether you are on none, quarantine or reject, and whether a subdomain policy is set.
- Test the report address. Confirm the rua mailbox exists and that reports are arriving.
- Compare alignment settings with how you send. Strict alignment can cause failures if any service sends from a subdomain.
Once the record checks out, the next step is to look at what the reports are telling you. That is where most of the real insight lives. Reports show you what the record alone cannot: who is sending email as your domain.
How Do You Read DMARC Reports During an Audit?
Aggregate reports are summaries sent by receiving servers, usually once a day. Each one lists the IP addresses that sent email using your domain, how many messages they sent, and whether those messages passed SPF, DKIM, and DMARC. They arrive as XML files, which are not pleasant to read by hand.
That is why most teams use a DMARC report analyzer. These tools collect your reports and turn the XML into readable tables and charts. Some offer free plans, which are often enough for a smaller sender.
With the reports in readable form, sort every sending source into two groups. The first group is legitimate services you use, such as your marketing platform, your CRM, or your help desk. The second is anything you do not recognize, which may be misconfigured tools or someone spoofing your domain.
Then focus on legitimate senders that are failing. Trace each failure back to its cause, whether that is a missing SPF include, an unsigned DKIM setup, or an alignment mismatch. Failure reports, requested with ruf, can add detail, but many receiving servers send few or none for privacy reasons, so aggregate reports do most of the work.
How Do You Move From p=none to Enforcement Safely?
Moving to enforcement is where DMARC starts protecting you, but it should be done in stages. Rushing straight to reject can block your own campaigns. A steady approach keeps your email flowing while you tighten the rules.
Start by fixing every legitimate sender that fails in your reports. Once your genuine email passes consistently, move to p=quarantine. If you want to be extra careful, stay on quarantine longer and check your reports closely before moving to reject.
After quarantine runs cleanly, move to p=reject. Keep watching your reports after each change, because new tools and new team members can introduce new senders. Common slip-ups include forgetting a sending service, using a report address nobody checks, and skipping the monitoring step entirely.
DMARC is not a one-time task. Re-audit it whenever you add a service that sends email for your domain, and on a regular schedule after that. Put it on the same calendar as your other email reviews, so it gets checked alongside list health and campaign performance.
Frequently Asked Questions
What is DMARC in email?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a DNS record that tells receiving servers what to do with emails that fail SPF and DKIM checks. It also sends you reports about who is sending email from your domain.
How do I check if my domain has a DMARC record?
Use a free online DMARC lookup tool and enter your domain. You can also run dig TXT _dmarc.yourdomain.com from a command line. If nothing comes back, your domain has no DMARC record.
What is the difference between p=none, p=quarantine and p=reject?
A p=none policy only monitors and takes no action on failing emails. A p=quarantine policy usually sends failing emails to spam. A p=reject policy blocks them completely.
What are DMARC aggregate reports?
Aggregate reports are summaries that receiving servers send to the address in your rua tag. They show which IP addresses sent email using your domain and whether those emails passed authentication. Most teams read them through a report analyzer because the raw files are XML.
How do I audit my DMARC setup?
Check that one valid record exists, review the policy and confirm reports are arriving. Then read your aggregate reports to find every sending source and any legitimate senders that fail. Fix those failures before tightening your policy.
How long should I stay on a p=none policy?
Stay on p=none until your reports show that all your legitimate email passes DMARC consistently. For some domains that is a few weeks, and for domains with many sending services it can take longer. The aim is to move on once the data supports it, not to stay there indefinitely.
Why does DMARC fail when SPF and DKIM pass?
DMARC also requires alignment. If SPF or DKIM passes for a domain that does not match your visible "From" domain, DMARC still fails. Setting up domain authentication with your own domain usually fixes this.
Is DMARC required for email marketing?
Some of the largest mailbox providers now require bulk senders to publish a DMARC record. Even where it is not required, it protects your brand and supports deliverability. For any business sending marketing email, it is worth setting up.
Is Your Domain Ready for Full DMARC Protection?
DMARC is where email authentication starts to enforce something. It links SPF and DKIM to the address your subscribers see, tells receivers what to do with failures, and reports on every source using your domain. Without it, the other two records have no say in what happens when a check fails.
The safest route to full protection is gradual. Start at p=none, use aggregate reports to find and fix every legitimate sender, then move through quarantine to reject while you keep monitoring. Re-audit whenever a new tool starts sending on your behalf, because that is when most surprises appear.
With authentication handled, attention can shift to how campaigns perform in the inbox.
Email Audit Engine runs a free email marketing audit on Mailchimp campaign data, which gives you a quick read on engagement once deliverability is under control. It is a quick way to see how your campaigns are performing with subscribers now that the technical groundwork is in place.