Skip to content
newsletter-marketing24.deLaw · Deliverability · Metrics

Last reviewed:

Translated from German; if the versions differ, the German version applies.

DMARC

In short: DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record under _dmarc. of a domain. It requires the sender domain visible in the inbox to match a passed SPF or DKIM check, tells receivers how to treat messages where this is not the case, and names an address for reports.

What DMARC checks

SPF and DKIM each confirm a domain, but not necessarily the one that readers see in the “From:” field. DMARC closes this gap with alignment: at least one of the two methods must have passed, and for a domain that matches the sender domain (RFC 9989, Section 4.4). If none matches, the result is “fail”.

The receiver looks up the record under _dmarc. in front of the sender domain, so for example.de under _dmarc.example.de (Section 4.5). RFC 9989 recommends using SPF and DKIM together as the basis for DMARC.

The most important tags:

  • p – the DMARC policy: none (observe only), quarantine (treat as suspicious) or reject (reject)
  • rua – address for the aggregate reports, whose format is set out in RFC 9990
  • sp and np – different policies for subdomains and for non-existent subdomains
  • adkim and aspf – alignment relaxed (r, the default) or strict (s)
  • t – test mode; it replaces the former percentage value pct, which RFC 9989 has removed (Appendix A.6)

How it differs

  • DMARC and SPF/DKIM: DMARC is not a third check alongside SPF and DKIM, but evaluates their results. Without at least one of the two, DMARC cannot pass.
  • RFC 9989 and RFC 7489: Until May 2026, RFC 7489 described DMARC as an informational document. RFC 9989 replaces it and is on the standards track; besides pct, other details have also changed.
  • DMARC report: The record itself is a policy; the XML files that receivers send to the rua address are the DMARC reports.

Easily confused

  • “dmarc=fail” does not mean “spam”. The result only says that there was no matching authentication. What the receiver does with it is up to the receiver; the policy is a request by the domain owner.
  • p=none is no protection. This policy expressly asks receivers not to treat messages differently. It is there for observing via the reports. Gmail accepts p=none from bulk senders; for a brand logo via BIMI, however, Google requires quarantine or reject.

Example

The first record for a whole domain in monitoring mode, as RFC 9989 shows it in Appendix B.2.1 (here with the example domain example.de):

_dmarc.example.de.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-berichte@example.de"

Later, once the reports show that all of your own sending routes pass, a stricter stage follows. With t=y, a new policy can first be announced in test mode:

_dmarc.example.de.  TXT  "v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc-berichte@example.de"

Frequently asked questions

How do I run a DMARC check? Look up the TXT record under _dmarc. of your domain (for example nslookup -type=TXT _dmarc.example.de). If there is exactly one record beginning with v=DMARC1, DMARC is published. Whether your emails pass DMARC is shown by the aggregate reports and by the Authentication-Results header of a received message.

Who requires DMARC? Gmail requires a DMARC record from senders who send more than 5,000 messages a day to Gmail accounts; p=none is enough there. Yahoo requires bulk senders to publish a valid DMARC record with at least p=none and requires DMARC to pass.

What is a DMARC generator? A tool that assembles the record from selection fields. Our DMARC builder does this under RFC 9989 in your browser, without looking up your domain.

Can a domain have several DMARC records? No. If the receiver finds several valid records for the same name, it discards them (RFC 9989, Section 4.10).

Matching tool

  • DMARC builder: put together a record under RFC 9989, with every option explained.