# What is DMARC and how does it protect your domain?

Source: https://dijituldns.co.uk/guides/what-is-dmarc/
Updated: 2026-10-19

> DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails checks. It passes when SPF or DKIM passes and aligns with the From address. dijitul sets up DMARC and reads the reports at £45 an hour + VAT.

## Key facts

- DMARC is a TXT record at _dmarc.yourdomain.
- It passes when SPF or DKIM passes and aligns with the From domain.
- Policies: p=none (monitor), p=quarantine (spam folder), p=reject (block).
- rua= sets where daily aggregate reports are sent.
- Gmail and Yahoo bulk senders need DMARC of at least p=none.
- BIMI needs DMARC at quarantine or reject.

## What DMARC does

Anyone can put your domain in the From line of an email. SPF and DKIM let receiving servers check whether a message really came from a sender you allow, but on their own they do not say what to do if the check fails, and they do not check the address people actually see. DMARC fills both gaps.

A DMARC record is a TXT record at `_dmarc.example.co.uk`, for example:

`v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk`

It tells receivers your policy for mail that fails, and where to send reports. For the step by step setup of all three records, see [SPF, DKIM and DMARC setup](https://dijituldns.co.uk/guides/spf-dkim-dmarc-setup/).

## Alignment: the key idea

DMARC passes when **either** SPF or DKIM passes **and** the domain it checked matches the domain in the visible From address. That match is called alignment.

- **SPF alignment:** the domain in the hidden return path (envelope sender) must match the From domain.
- **DKIM alignment:** the d= domain in the DKIM signature must match the From domain.

By default alignment is relaxed, so a subdomain such as mail.example.co.uk counts as matching example.co.uk. This is why third party senders such as newsletter or invoicing tools can pass SPF and DKIM yet still fail DMARC: they sign with their own domain. The fix is to set up DKIM for your domain in each tool.

## Policies and reports

| Policy | What receivers do with failing mail |

| `p=none` | Deliver as normal, but send you reports |
| `p=quarantine` | Treat as suspicious, usually the spam folder |
| `p=reject` | Refuse the message |

The `rua=` tag gives an address for **aggregate reports**. Large mailbox providers send these as XML files, usually daily, listing which servers sent mail as your domain and whether each passed. They are hard to read raw, so most people use a report service or ask someone to summarise them. An optional `sp=` tag sets a different policy for subdomains.

## A safe rollout

- **Get SPF and DKIM right** for every service that sends as your domain.
- **Publish p=none with rua** and collect reports for a few weeks.
- **Fix what the reports show:** forgotten senders, tools without DKIM, forwarding issues.
- **Move to p=quarantine** once genuine mail passes consistently.
- **Move to p=reject** when quarantine causes no problems.

Jumping straight to reject can block your own invoices or newsletters. If mail is already landing in spam, read [why emails go to spam](https://dijituldns.co.uk/guides/emails-going-to-spam/) first.

## Bulk sender rules and BIMI

Since February 2024, Google and Yahoo require bulk senders (around 5,000 or more messages a day to personal Gmail accounts) to have SPF, DKIM and DMARC of at least p=none, with alignment. Since 5 May 2025, Microsoft asks the same of domains sending over 5,000 messages a day to Outlook.com, Hotmail and Live addresses. Enforcement details change, so treat p=none as the minimum, not the goal.

BIMI, which can show your logo next to your emails in some inboxes, needs DMARC at quarantine or reject, an SVG Tiny PS logo and, for Gmail, a VMC or CMC certificate.

We set up DMARC, read the reports and move you safely to enforcement at £45 an hour + VAT. See [SPF, DKIM and DMARC records](https://dijituldns.co.uk/spf-dkim-dmarc-records/) or [ask for a quote](https://dijituldns.co.uk/quote/).

## FAQs

### Do I need DMARC if I only send a few emails?

Yes, it is worth having. Small senders are not covered by the bulk rules, but DMARC still makes it harder for criminals to send convincing fake emails from your domain, and many receivers treat mail from domains with DMARC more favourably than mail from domains without.

### What DMARC policy should I start with?

Start with p=none and a rua address so you receive reports without affecting delivery. Once the reports show all genuine mail passing SPF or DKIM with alignment, move to p=quarantine, then to p=reject.

### Why does my email pass SPF but fail DMARC?

Usually an alignment problem. SPF checked the return path domain, which belongs to the sending service, not your From domain. Set up DKIM for your own domain in that service so it signs with a matching d= domain.

### What are DMARC aggregate reports?

They are XML files that mailbox providers send, usually daily, to the address in your rua tag. They list the servers that sent mail as your domain, how many messages and whether SPF, DKIM and DMARC passed. They show you who is using your domain.

### Can DMARC stop my own emails being delivered?

At quarantine or reject, yes, if a genuine sender is not set up with aligned SPF or DKIM. That is why you start at p=none, read reports and fix every sender before tightening the policy.

### Where does the DMARC record go?

It is a TXT record at _dmarc followed by your domain, for example _dmarc.example.co.uk. In most DNS control panels you enter _dmarc as the name and the policy text, starting v=DMARC1, as the value. There should be only one.

## Prices and contact

Domains are priced live in the client portal. DNS management and 10 mailboxes are included with dijihost Complete Hosting at £1 a day + VAT. On their own, DNS and email set-up is £45 an hour + VAT or a fixed quote. Domain search and registration: https://clients.dijitul.uk. Hosting: https://dijihost.co.uk/ (£1 a day + VAT). Contact: https://dijituldns.co.uk/contact/ · 01623 650333 · info@dijitul.uk