What DMARC does
DMARC is a TXT record at _dmarc.<domain>. It tells receivers what to do with mail whose From domain fails SPF and DKIM alignment, and where to send reports about it. Gmail and Yahoo require a DMARC record from bulk senders.
| Tag | What it sets |
|---|---|
p | Policy: none (monitor), quarantine (spam folder) or reject |
rua | Where aggregate reports are sent (mailto: address) |
sp | Policy for subdomains, when different |
pct | Share of failing mail the policy applies to |
adkim / aspf | Alignment: relaxed (r, default) or strict (s) |
A safe path to enforcement
- 1Publish
v=DMARC1; p=none; rua=mailto:[email protected]and collect reports for a few weeks. - 2Fix every legitimate sender the reports show failing (add it to SPF, turn on DKIM signing).
- 3Move to
p=quarantine, then top=rejectonce reports stay clean.