What is DMARC and How Does it Work?

What is DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email security protocol that allows domain owners to specify how unauthenticated emails should be handled—and provides visibility into who is sending mail on behalf of their domain.

Understanding DMARC

DMARC helps protect your domain from email spoofing, phishing attacks, and other forms of abuse. It works by building on two established authentication technologies:

• SPF (Sender Policy Framework)
• DKIM (DomainKeys Identified Mail)

Together, these tools help verify that an email actually comes from the domain it claims to be from. DMARC adds an extra layer by allowing domain owners to define policies for handling unauthenticated emails, and receive reports on authentication results.

How Does DMARC Work?

To enable DMARC, domain owners add a TXT record to their DNS settings. This record outlines the domain’s DMARC policy using a set of tags and values that define:

• What to do with emails that fail SPF/DKIM checks (e.g., reject, quarantine, or allow them through)
• Where to send authentication reports
• How strictly to enforce the policy

When an email is received, the recipient’s mail server checks for a DMARC record on the sender’s domain. It then verifies:

1. Does the message pass SPF and/or DKIM checks?
2. Do the domains used in those checks “align” with the domain in the From: header?

If alignment is achieved, the message passes DMARC. If not, the receiver acts based on the policy—either rejecting, quarantining, or delivering the message.

Why is DMARC Important?

DMARC boosts email security by:

• Preventing attackers from sending fraudulent emails using your domain
• Improving deliverability of legitimate messages
• Giving insight into how your domain is being used or misused

For domain owners, DMARC reports provide valuable data about email traffic and help identify spoofing or misconfigurations. For receivers, DMARC helps filter suspicious emails before they reach inboxes.

Limitations of DMARC

While powerful, DMARC has a few key limitations:

• Mutual adoption required: Both sender and receiver must support DMARC for it to work.
• Depends on SPF and DKIM: These technologies have their own issues (e.g., problems with email forwarding or complex key management).
• No content protection: DMARC verifies sender identity, not the message content—it does not encrypt emails or prevent them from being intercepted.
• Domain misuse still possible: A sender could use a different (but legitimate) domain that passes SPF/DKIM—even if it’s not under your control.

DMARC Syntax

DMARC syntax is the format and structure of the DMARC record that is added to the DNS of the email domain. The DMARC record is a TXT record that starts with the prefix “v=DMARC1;”, followed by a series of tags and values separated by semicolons. Each tag represents a different aspect of the DMARC policy, and each value defines the setting or option for that tag. The tags and values are case-insensitive, but the order of the tags does not matter. The following table summarizes the main tags and values that can be used in a DMARC record, along with their meanings and examples.

DMARC Syntax Example