DMARC

DMARC (RFC 9989, which replaced RFC 7489) ties SPF and DKIM to the address people actually see: the domain in the From: header. A message passes DMARC when SPF passes for a domain aligned with the From: domain, or DKIM passes with a d= domain aligned with it. Alignment can be relaxed (same organisational domain, so mail.acme.com aligns with acme.com) or strict (exact match), set with the aspf and adkim tags.

The policy is a DNS TXT record at _dmarc.domain, for example v=DMARC1; p=none; rua=mailto:[email protected]. The p= tag tells receivers what to do with failing mail: none (monitor only), quarantine (treat as suspicious, typically the spam folder) or reject (refuse it). Most domains start at none, read the reports, and move to quarantine and then reject once their legitimate mail passes.

The rua tag requests aggregate reports: daily XML summaries from receivers showing which IPs sent mail using your domain and whether they passed. These reports are how domain owners find unauthorised senders and misconfigured tools before tightening the policy.

Google requires senders of more than 5,000 messages a day to Gmail accounts to publish DMARC, and Yahoo asks bulk senders for a policy of at least p=none that passes. Even if your outreach volume is lower, DMARC protects your main domain from being spoofed, and a passing, aligned message is treated better than an unauthenticated one.

Skrap.ai doesn't publish or manage DMARC; that's a DNS record you set at your domain host. Read any domain's policy with the free DMARC checker. Skrap's part is your list: verify addresses with the free email verifier so authentication isn't undermined by bounces from addresses that don't exist.