Short, RFC-checked answers on DMARC policies, alignment, reports, forwarding, subdomains, BIMI and how DMARC relates to SPF and DKIM.
These answers cover DMARC (RFC 7489) and the two checks it builds on, SPF (RFC 7208) and DKIM (RFC 6376). Each one was checked against the standard or the provider's own page on 19 October 2026. An older version of this page said DMARC stops phishing outright. It does not, and the answer below explains why.
DMARC (Domain-based Message Authentication, Reporting and Conformance, now defined in RFC 9989, which replaced RFC 7489 in May 2026) is a TXT record published at _dmarc.yourdomain. It tells receivers what to do with mail that fails SPF and DKIM alignment with your From domain, and where to send reports about it.
Without it, anyone can send mail that shows your exact domain in the From line, and receivers have no instruction from you on how to treat it. DMARC also gives you reports showing every server sending as your domain. Gmail now requires a DMARC record from anyone sending 5,000 or more messages a day to personal Gmail accounts.
Only one kind. At p=quarantine or p=reject it blocks mail that spoofs your exact domain in the From address. It does nothing against lookalike domains, a fake display name on a free mailbox, or mail from a real account that was compromised.
SPF checks whether the sending server is allowed for the envelope sender domain, and DKIM checks a signature for the domain in its d= tag. Neither looks at the visible From address. DMARC passes a message when SPF or DKIM passes for a domain aligned with From, and applies your policy when neither does.
It is not a term from the RFC. In practice it means a message passed DMARC, or that a domain publishes a valid record, often at p=quarantine or p=reject. Check which meaning a vendor or auditor is using before you answer them.
It can. Forwarding changes the sending IP, so SPF fails, and mailing lists that edit the subject or footer can break DKIM. ARC (RFC 8617, an Experimental standard) lets the forwarder record the original results so the final receiver can choose to trust them, and a valid DKIM signature is the best protection on your side.
Alignment means the domain that passed SPF or DKIM matches the From domain. Relaxed (the default, aspf=r and adkim=r) accepts the same organisational domain, so mail.example.com aligns with example.com. Strict (s) needs an exact match.
p=none asks receivers to deliver failing mail as they would anyway and to send you reports. It gives no protection by itself. Use it to find your senders, then move to quarantine and reject.
rua is the address for aggregate reports: daily XML summaries of sending IPs, message counts and SPF, DKIM and DMARC results. ruf is the address for failure reports about single messages. Many receivers do not send ruf reports at all because they can contain message content.
There is no fixed timeline in any standard. The time goes into finding every service that sends as your domain and giving each one aligned SPF or DKIM. Move to quarantine, then reject, once your aggregate reports show only legitimate sources and they all pass.
Yes, mostly in your favour. Gmail says mail from a domain with no DMARC policy may be rate limited, rejected or sent to spam if you are a bulk sender. The risk is setting quarantine or reject before your own tools are aligned, which sends your real mail to spam or bounces it.
Yes. A subdomain with no record of its own uses the organisational domain's record, and the sp tag sets its policy; if sp is absent, p applies. RFC 9989 (May 2026) adds an np tag for subdomains that do not exist in DNS, which falls back to sp and then p when absent.
No. If a receiver finds more than one v=DMARC1 record at _dmarc, RFC 7489 says policy discovery stops and DMARC is not applied to the message at all. Merge everything into one record, listing several report addresses in rua separated by commas.
The BIMI Group requires DMARC at enforcement on the organisational domain and its subdomains: p=quarantine or p=reject, with sp not set to none. A p=none policy or a pct value below 100 is not accepted.
Run the free DMARC, SPF and DKIM checks, or start a 14-day trial of DMARC+ reporting.