Home / Learn / What is DMARC?

What is DMARC?

DMARC ties SPF and DKIM to the address people see in the From line, and tells receivers what to do with mail that fails.

Updated 2026-10-18

TL;DR

  • DMARC is a DNS record at _dmarc.yourdomain.com that sets a policy: none, quarantine or reject.
  • Mail passes DMARC when SPF or DKIM passes and that domain aligns with the From address.
  • Gmail requires DMARC (policy can be none) from senders of more than 5,000 messages a day, and Outlook.com announced similar rules from May 2025.

The short definition

DMARC builds on SPF and DKIM. Those two prove something about a message, but not necessarily about the From address a person sees. DMARC says: "mail claiming to be from my domain must pass SPF or DKIM using my domain, and here is what to do with mail that doesn't". It also asks receivers to send you reports.

A starter record

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"
  • p= is the policy. none only monitors, quarantine asks for spam-folder treatment, reject asks receivers to refuse the mail.
  • rua= is where aggregate reports are sent, which show who is sending as your domain.

Most domains start at p=none, read the reports, fix any legitimate sender that fails, then tighten.

Alignment

Alignment is the part people miss. Passing SPF for a tool's own return-path domain doesn't help if your From address uses a different domain. Google states it plainly: for direct email the From domain must align with the SPF or DKIM domain, which is needed to pass DMARC.

Who requires DMARC

  • Gmail: bulk senders (more than 5,000 messages a day to Gmail) must set up DMARC, and the policy "can be set to none". All senders need SPF or DKIM (Google email sender guidelines, checked 2026-10-18).
  • Outlook.com: Microsoft's postmaster site says that from 5 May 2025 high-volume senders (over 5,000 emails a day) must meet stricter SPF, DKIM and DMARC standards, with non-compliant mail going to junk and rejection to follow (Outlook.com postmaster site, checked 2026-10-18).

Most cold-email senders are below 5,000 a day per domain, but DMARC still protects your brand from spoofing and is quick to add.

DMARC and email verification

Passing DMARC won't save a campaign aimed at dead addresses. Bounces are about the recipients: see bounce codes and how many bounces burn a domain. Verify first (free trial), authenticate second.

Authentication is not verification. SPF, DKIM and DMARC describe how a domain sends mail. They do not say whether a mailbox exists. Mail Exchange checks the second thing (syntax, MX, risk lists, SMTP mailbox check and a catch-all test), so use both: authenticate your sending domain and verify your list.

To look up your record, use the free email authentication checker, which checks SPF, DKIM, DMARC and MX for up to 25 domains.

Sources

Common questions

What is DMARC in simple terms?

A DNS record that tells receivers what to do with mail that claims to be from your domain but fails SPF and DKIM alignment, and where to send reports.

What DMARC policy should I start with?

Most senders start with p=none to monitor, read the reports, fix legitimate senders, then move to quarantine and reject.

Does DMARC check whether an email address exists?

No. DMARC is about the sender. Checking whether a recipient mailbox exists is email verification.

Related

Start your free trial →