DMARC is a public instruction in your DNS that tells receiving servers what to do with email that claims to come from your domain but fails authentication. It also asks them to send you reports about what they see.
DMARC does not check email by itself. It looks at the results of SPF and DKIM and asks whether at least one of them passes and matches the domain in the visible From address. If neither does, the message fails DMARC.
It is a TXT record published at _dmarc followed by your domain. It starts with v=DMARC1 and contains a policy written as p=, which can be none, quarantine or reject. An optional rua= tag gives an address for summary reports.
Without DMARC, each receiving server decides on its own what to do with failing email. With it, you state your wish, and you learn who is sending email in your name.
Look up the TXT record at _dmarc.yourdomain. If nothing comes back, no DMARC record exists for that name.
DNS Domain Detective reads your DMARC record and shows what to fix. Open DNS Domain Detective
DNS Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#DNS #DKIM #SPF #DMARC #EmailSecurity #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]