Domain-based Message Authentication, Reporting & Conformance (RFC 7489) — defines domain policy and failure reporting on top of SPF/DKIM. Configure the p policy, alignment and report addresses to generate a standard DMARC TXT record.
Recommended path: run none for 2-4 weeks to confirm no legitimate mail fails, then escalate to quarantine, then reject (RFC 7489 §6.3 recommends incremental deployment).
RFC 7489 §6.3: the sp tag is optional; when unset, subdomains inherit the main domain policy.
RFC 7489 §6.1: relaxed mode allows subdomain/main-domain inter-recognition; strict mode requires exact domain match. If you send from many subdomains, relaxed is recommended.
RFC 7489 §7.1: rua is strongly recommended (without it you cannot monitor via aggregate reports); ruf is optional. The report mailbox domain may differ from or equal the DMARC domain, but use a dedicated address to avoid abuse.
DMARC (RFC 7489) builds on SPF and DKIM: when receivers judge either SPF or DKIM to pass with domain alignment, DMARC is pass; otherwise the p policy applies. DMARC addresses exactly the spoofing of the visible From domain that SPF/DKIM alone cannot cover (subdomain impersonation, display-name spoofing).
Record location: TXT record at _dmarc.yourdomain.com. The value starts with v=DMARC1; tags are separated by semicolons. A domain can have only one DMARC record.
Reporting: rua aggregate reports (one XML per day) are sent by receivers; ruf forensic reports contain original mail samples. Use tools like DMARC XML report parser to analyze rua reports.
Typical example: v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=r; aspf=r; pct=100
Note: DMARC only takes effect when at least one of SPF/DKIM is correctly configured. If neither is configured, DMARC can only report, not protect. After generating, verify the full chain with our Email DNS One-Click Diagnostic.
Standards: RFC 7489 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM).