DMARC, SPF and DKIM explained
Three DNS records decide whether someone else can send email as your domain. SPF lists your servers, DKIM signs your messages, and DMARC tells receivers what to do when both checks fail to match the address your recipients see.
What is DMARC?
RFC 9989 (was RFC 7489)
Tells receivers what to do when mail claiming your domain fails SPF and DKIM alignment, and sends you reports on who is sending as you.
Read the primerWhat is SPF?
RFC 7208
A TXT record that lists the servers allowed to send for your domain. Receivers check it against the envelope sender, not the visible From line.
Read the primerWhat is DKIM?
RFC 6376
A cryptographic signature on each message. The public key sits in DNS under a selector, so receivers can check the mail was not changed and who signed it.
Read the primerGuides
Want someone to read the reports for you?
DMARC+ collects your aggregate reports, maps every sender and guides you from p=none to p=reject.
Start a 14-day free trial