Private email infrastructure & deliverability engineering
northboundmail.net
NorthboundMail Systems
Est. 2011 — SMTP infrastructure & deliverability
Knowledge base

DMARC Guide

How DMARC ties SPF and DKIM together, staged policy rollout from monitor to reject, and how to use aggregate reports.

Last updated March 2025 · 12 min read

DMARC (RFC 7489) is a policy layer built on top of SPF and DKIM. It answers three questions: what should the receiver do with a message that fails authentication (p=none, quarantine or reject), what fraction of failing traffic should that policy apply to (pct=), and where should the domain owner receive reports (rua= and ruf=). Without DMARC, SPF and DKIM produce only local receiver decisions; with DMARC, the domain owner asserts a policy.

The DMARC record

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=r; aspf=r; pct=100"

Key tags: p= policy (none, quarantine, reject); rua= aggregate report destination; ruf= forensic (per-message) reports, rarely useful now; adkim= and aspf= alignment mode (r=relaxed, s=strict); pct= percentage of failing mail the policy applies to; sp= subdomain policy override.

Staged rollout

  1. Publish p=none with rua= to a mailbox you monitor. Change nothing else.
  2. Ingest aggregate reports for 4–8 weeks. Identify every legitimate sender that is not authenticating. Add each to SPF, or DKIM-sign them, or eliminate them.
  3. Move to p=quarantine with pct=25, then 50, then 100 over several weeks. Watch reports for any legitimate traffic being quarantined.
  4. Move to p=reject with pct=100 once all legitimate mail authenticates cleanly.

Skipping the monitoring phase and going straight to p=reject reliably blocks legitimate mail — invoices from your accounting system, calendar invites from your CRM, notifications from your HR tool. The report phase is not optional.

Alignment

DMARC requires that either SPF or DKIM (or both) pass AND align. Alignment means the authenticated domain matches the header From domain, either exactly (strict) or on the organisational domain (relaxed). Most senders should use relaxed on both axes.

Aggregate reports

Receivers send daily XML reports summarising authentication results per sending source. Ingest them into an analysis tool that groups by source and shows pass/fail trends. This is where you discover that your CRM has been sending on your domain for four years without anyone knowing.

ARC and forwarding

Authenticated Received Chain (ARC) allows forwarding servers to attest that a message was authenticated when they received it, letting downstream receivers give partial credit even after SPF is broken by forwarding. Support is uneven; treat it as a supplement, not a substitute.

BIMI, VMC and DMARC

BIMI requires an enforcing DMARC policy (quarantine or reject). Getting to enforcement is a prerequisite for logo display. VMC (Verified Mark Certificate) is the extra step required by Gmail, Yahoo, Apple and others to display the logo — issued only against registered trademarks.

Related articles

  • SPF Explained
    How Sender Policy Framework works, how to author a record correctly, and how to avoid the common failure modes.
  • DKIM Explained
    DomainKeys Identified Mail — how signing works, selector strategy, key length and rotation, and what DKIM cannot do.
  • Google Postmaster Guide
    How to set up Postmaster Tools, what each metric means, and how to interpret the reputation graph.
  • PowerMTA Optimization
    VMTA design, queue tuning, per-domain policy, and the configuration mistakes that quietly cost inbox rate.
  • IP Warm-up
    How to warm a new IP without wasting weeks or torching reputation. Volume curves, segmentation, and when to stop.
  • Dedicated vs Shared IP
    When each is appropriate, the volume thresholds that make dedicated worthwhile, and the myths on both sides.