MailSlurp logo

guides

DMARC Explained: What It Does, How Alignment Works, and How to Roll It Out

Learn what DMARC is, how SPF and DKIM alignment affect pass or fail outcomes, and how to roll out monitoring and enforcement without breaking legitimate mail.

Use with your tools
View MarkdownAgent setupllms.txt
DMARC Explained: What It Does, How Alignment Works, and How to Roll It Out article preview

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It is the policy layer that tells mailbox providers how to evaluate messages claiming to be from your domain after they have checked SPF and DKIM.

The goal is to stop someone else's mail from passing itself off as yours. DMARC connects authentication results to the From domain your recipients see, and lets you request how receivers handle failures.

Quick answer

DMARC does three important things:

  • checks whether SPF or DKIM passed in an aligned way
  • tells receivers what to do when messages fail
  • sends reports so teams can see who is sending on behalf of the domain

That makes DMARC useful for both anti-spoofing and operational sender hygiene.

What DMARC actually solves

Before DMARC, a domain owner had fewer ways to express how receiving systems should treat mail that appeared to come from that domain.

DMARC improves that by connecting three ideas:

  • authenticated identity
  • visible From-domain protection
  • receiver policy guidance

This matters because a message can look legitimate to a user while still failing sender authenticity checks in ways that damage trust or allow spoofing.

How DMARC passes or fails

DMARC does not replace SPF or DKIM. It evaluates their results.

A simplified DMARC decision looks like this:

  1. Receiver checks SPF.
  2. Receiver checks DKIM.
  3. Receiver compares authenticated domains with the visible From domain.
  4. DMARC passes if SPF or DKIM passes and aligns with policy rules.

That "and aligns" part is what causes many real-world failures.

DMARC alignment in plain English

Alignment means the domain proven by SPF or DKIM must match the domain users actually see in the From address, or be an allowed organizational relation depending on strict or relaxed settings.

SPF alignment

SPF alignment compares the authenticated envelope-sender domain with the visible From domain.

DKIM alignment

DKIM alignment compares the signing domain in d= with the visible From domain.

This is why teams often see confusing cases like:

  • SPF pass, DMARC fail
  • DKIM pass, DMARC fail
  • DMARC pass because DKIM aligned even though SPF did not

Example DMARC record

A basic monitoring-first record often looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100

A stricter record may add more policy detail:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s; pct=100

The syntax matters, but the bigger question is whether your sender inventory and alignment are ready for enforcement.

What the main DMARC tags mean

p

Defines the requested receiver policy when DMARC fails.

rua

Specifies where aggregate reports should go.

ruf

Specifies forensic or failure reporting where supported.

pct

Applies enforcement to only a percentage of mail.

adkim and aspf

Control strict vs relaxed alignment for DKIM and SPF.

Why DMARC reporting matters

Reporting is one of DMARC's biggest advantages. It helps teams discover:

  • authorized senders that were never documented
  • spoofing attempts against the domain
  • vendor systems with broken alignment
  • regressions after mail platform changes

This is why the normal rollout starts with observation, not rejection.

Safe rollout model

Use this sequence:

  1. Publish p=none.
  2. Collect reports and inventory all legitimate senders.
  3. Fix SPF and DKIM alignment gaps.
  4. Move to quarantine in a controlled window.
  5. Observe effects on real traffic.
  6. Move to reject after confirming that legitimate senders pass DMARC.

For deeper policy detail, use DMARC policy guide. If you are troubleshooting live failures instead of planning rollout, use DMARC fail. If you are preparing to enforce or recovering from blocked mail, continue with DMARC reject. If Google Workspace is one of your active sender paths, use Google Workspace DMARC for the provider-specific rollout and alignment model.

Common DMARC failure patterns

Legitimate vendor mail is not aligned

The vendor can send mail, but its return-path or signing domain does not align with your visible From domain.

DKIM rotation broke alignment

The selector or signing setup changed, and the new path was not rolled out cleanly.

SPF inventory is incomplete

An old app, billing system, or CRM still sends mail but was left out of policy planning.

Enforcement was raised too quickly

The domain moved to reject before reports were stable enough to prove sender health.

DMARC vs SPF vs DKIM

Use them together:

  • SPF proves sending-host authorization
  • DKIM proves signed message integrity and domain authorization
  • DMARC decides whether that proof aligns with the From domain users see

If you treat them as independent toggles, you will miss the operational connection between them.

Related pages:

How to validate DMARC before a release

Before changing authentication records, sender domains or DMARC policy:

This is especially important for signup, billing, support, and security notification flows.

Use MailSlurp for DMARC checks

Use the DMARC checker to inspect the published record, then the email header analyzer to read authentication results from a received message. After changing the sender or policy, repeat your email deliverability test and compare the results.

FAQ

What is DMARC in simple terms?

DMARC is the policy system that tells receivers how to treat email that claims to be from your domain when SPF or DKIM does not align correctly.

Does DMARC require both SPF and DKIM to pass?

No. DMARC can pass if SPF or DKIM passes and aligns with the visible From domain policy.

Should every domain start with p=reject?

Usually no. Start with monitoring, then move toward enforcement only after sender mapping and alignment are healthy.

Why do teams use DMARC reports?

To understand who is sending mail on behalf of the domain, spot alignment problems, and detect spoofing or regressions.