What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It lets a domain owner publish a policy for mail that fails SPF or DKIM alignment.

Alignment is the key idea. A message can pass SPF or DKIM technically, but DMARC checks whether the authenticated domain aligns with the visible From domain that recipients see.

A p=none policy collects reports without asking receivers to block mail. It is useful when you are discovering legitimate senders and fixing alignment.

A p=quarantine policy tells receivers to treat failing messages as suspicious, often by placing them in spam. A p=reject policy asks receivers to reject failing messages outright. Most domains should move gradually from none to quarantine to reject after reviewing reports.

DMARC aggregate reports show which sources are sending on behalf of your domain and whether their mail passes SPF, DKIM, and alignment. Those reports are the evidence you need before enforcing a stricter policy.

The practical workflow is simple: publish DMARC, collect reports, identify legitimate sources, fix failures, then raise enforcement once normal mail is passing reliably.