DMARC record and policy

The record at _dmarc telling receiving servers what to do with mail that fails SPF or DKIM, and where to report it. p=none only watches; p=quarantine and p=reject act on it.

• Help center

DMARC ties SPF and DKIM to the address people actually see in the From line, and tells receiving servers what to do when a message claiming to be from your domain fails both checks. It also asks them to send you aggregate reports, so you can see who is sending mail in your name — including services you forgot about.

The record lives in DNS as a TXT record at _dmarc.example.com and starts with v=DMARC1. Its key tag is the policy:

• p=none — only monitor and report; failing mail is delivered as usual.
• p=quarantine — send failing mail to spam.
• p=reject — refuse it outright.

How SiteScan grades it

The scan reads the _dmarc record of the registrable domain. Any published policy is green and the row shows it, p=none included: monitoring is the normal first stage of a rollout, not a misconfiguration. A missing record is a warning, because without it the domain is easy to spoof.

How to roll it out

Start with v=DMARC1; p=none; rua=mailto:dmarc@example.com, read the reports for a few weeks, fix the senders that fail SPF or DKIM, then move to p=quarantine and finally p=reject. Enforcement is also a prerequisite for BIMI. More in email authentication.