Key facts
- DMARC is a TXT record at _dmarc.yourdomain.
- It passes when SPF or DKIM passes and aligns with the From domain.
- Policies: p=none (monitor), p=quarantine (spam folder), p=reject (block).
- rua= sets where daily aggregate reports are sent.
- Gmail and Yahoo bulk senders need DMARC of at least p=none.
- BIMI needs DMARC at quarantine or reject.
What DMARC does
Anyone can put your domain in the From line of an email. SPF and DKIM let receiving servers check whether a message really came from a sender you allow, but on their own they do not say what to do if the check fails, and they do not check the address people actually see. DMARC fills both gaps.
A DMARC record is a TXT record at _dmarc.example.co.uk, for example:
v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk
It tells receivers your policy for mail that fails, and where to send reports. For the step by step setup of all three records, see SPF, DKIM and DMARC setup.
Alignment: the key idea
DMARC passes when either SPF or DKIM passes and the domain it checked matches the domain in the visible From address. That match is called alignment.
- SPF alignment: the domain in the hidden return path (envelope sender) must match the From domain.
- DKIM alignment: the d= domain in the DKIM signature must match the From domain.
By default alignment is relaxed, so a subdomain such as mail.example.co.uk counts as matching example.co.uk. This is why third party senders such as newsletter or invoicing tools can pass SPF and DKIM yet still fail DMARC: they sign with their own domain. The fix is to set up DKIM for your domain in each tool.
Policies and reports
| Policy | What receivers do with failing mail |
|---|---|
p=none | Deliver as normal, but send you reports |
p=quarantine | Treat as suspicious, usually the spam folder |
p=reject | Refuse the message |
The rua= tag gives an address for aggregate reports. Large mailbox providers send these as XML files, usually daily, listing which servers sent mail as your domain and whether each passed. They are hard to read raw, so most people use a report service or ask someone to summarise them. An optional sp= tag sets a different policy for subdomains.
A safe rollout
- Get SPF and DKIM right for every service that sends as your domain.
- Publish p=none with rua and collect reports for a few weeks.
- Fix what the reports show: forgotten senders, tools without DKIM, forwarding issues.
- Move to p=quarantine once genuine mail passes consistently.
- Move to p=reject when quarantine causes no problems.
Jumping straight to reject can block your own invoices or newsletters. If mail is already landing in spam, read why emails go to spam first.
Bulk sender rules and BIMI
Since February 2024, Google and Yahoo require bulk senders (around 5,000 or more messages a day to personal Gmail accounts) to have SPF, DKIM and DMARC of at least p=none, with alignment. Since 5 May 2025, Microsoft asks the same of domains sending over 5,000 messages a day to Outlook.com, Hotmail and Live addresses. Enforcement details change, so treat p=none as the minimum, not the goal.
BIMI, which can show your logo next to your emails in some inboxes, needs DMARC at quarantine or reject, an SVG Tiny PS logo and, for Gmail, a VMC or CMC certificate.
We set up DMARC, read the reports and move you safely to enforcement at £45 an hour + VAT. See SPF, DKIM and DMARC records or ask for a quote.
Frequently asked questions
Do I need DMARC if I only send a few emails?
Yes, it is worth having. Small senders are not covered by the bulk rules, but DMARC still makes it harder for criminals to send convincing fake emails from your domain, and many receivers treat mail from domains with DMARC more favourably than mail from domains without.
What DMARC policy should I start with?
Start with p=none and a rua address so you receive reports without affecting delivery. Once the reports show all genuine mail passing SPF or DKIM with alignment, move to p=quarantine, then to p=reject.
Why does my email pass SPF but fail DMARC?
Usually an alignment problem. SPF checked the return path domain, which belongs to the sending service, not your From domain. Set up DKIM for your own domain in that service so it signs with a matching d= domain.
What are DMARC aggregate reports?
They are XML files that mailbox providers send, usually daily, to the address in your rua tag. They list the servers that sent mail as your domain, how many messages and whether SPF, DKIM and DMARC passed. They show you who is using your domain.
Can DMARC stop my own emails being delivered?
At quarantine or reject, yes, if a genuine sender is not set up with aligned SPF or DKIM. That is why you start at p=none, read reports and fix every sender before tightening the policy.
Where does the DMARC record go?
It is a TXT record at _dmarc followed by your domain, for example _dmarc.example.co.uk. In most DNS control panels you enter _dmarc as the name and the policy text, starting v=DMARC1, as the value. There should be only one.
Related
Get domains, DNS and email sorted
Set up properly, records checked, and real people to call. DNS and email are included with dijihost hosting.