What Is DMARC?
DMARC checks whether a passing SPF or DKIM identity aligns with the domain in an email's visible From address. It also lets the domain owner request reports and publish a preference for handling messages that fail. It helps receivers assess authenticated use of a domain; it does not guarantee inbox placement.
By LeadHaste Editorial · AI-assisted editorial review ·
What alignment means
An email can involve several domains. The address a reader sees might be alex@example.com, while a sending platform uses a different envelope sender and signs with its own domain. Those roles matter because an authentication pass for an unrelated domain does not establish that the visible From domain authorized the message.
Under the DMARC model in RFC 9989, either an aligned SPF pass or an aligned DKIM pass can satisfy authentication. Both are useful to configure, but DMARC does not require both to pass on every message. Relaxed and strict alignment apply different domain-matching rules.
A conceptual example
Suppose a message shows alex@example.com in From. SPF passes for a platform's unrelated return-path domain. That SPF result alone does not provide DMARC alignment. If DKIM also passes with an aligned example.com signature, the message can pass DMARC through DKIM.
This example uses reserved domains to explain the relationship. A real investigation needs the recipient system's Authentication-Results header and the actual envelope-sender and signing domains. Forwarding and message modification can affect those results, so a DNS checker alone cannot explain every failure.
Policy and reports have different jobs
A DMARC record commonly appears as a TXT record under _dmarc followed by the domain. Its policy expresses the owner's requested handling: monitoring with none, quarantine, or reject. Receivers can apply local policy and exceptions; the published preference is not a promise of identical behavior everywhere.
Aggregate reports help identify which systems are sending and how their authentication behaves. They are useful for discovering a forgotten invoice platform or a new outreach provider. They do not show an inbox-placement result for every recipient.
What to check before changing enforcement
Inventory legitimate senders and identify who controls their signing settings and DNS records. Inspect real messages from each source. Review reporting coverage and investigate failures before tightening a policy that could affect customer-facing mail.
Keep setup instructions separate from the definition: copy the current records supplied by your provider, preserve existing legitimate senders, and verify the outcome after a change. A passing DMARC check resolves an identity question. Complaint rates, recipient expectations and filtering still influence delivery.
Sources
Useful next steps
Related terms
Put the pieces into a system you own.
Explore your ICP and campaign fit on a free discovery call, then decide what your outbound operation needs.
Book your free ICP review →