DMARC

If SPF and DKIM are the locks on your email domain, DMARC is the security guard reading the log. It is the one authentication record that turns everything else from theoretical protection into enforced policy — and, since Feb 2024, a hard requirement for sending to Gmail and Yahoo at scale.

What is DMARC?

DMARC is the third pillar of modern email authentication, built on top of SPF and DKIM. It solves three problems those two protocols left open:

• What should receivers do when SPF or DKIM fail? Before DMARC, each receiver decided on its own. DMARC gives the sender a way to declare the desired policy.
• How do we prevent header-From spoofing? SPF checks Return-Path; DKIM signs any domain it wants. DMARC enforces alignment between the visible From: address and the authentication domain.
• How does the sender see what is happening? DMARC reports (rua aggregate + ruf forensic) give the sender daily visibility into every source using its domain.

Why DMARC matters

Four concrete reasons every marketing and IT team implements DMARC in 2026:

1. Mandatory for bulk senders. Google and Yahoo require at least p=none DMARC for anyone sending 5,000+ messages/day since Feb 2024. Microsoft is rolling out similar rules.
2. Anti-phishing protection. An enforced DMARC policy blocks attackers from spoofing your domain in customer-facing phishing campaigns.
3. Deliverability lift. A properly aligned DMARC record signals a well-run sender to inbox providers, improving Primary tab placement.
4. Ecosystem visibility. DMARC aggregate reports reveal every third-party tool (invoicing, ATS, sales tools, ESPs) sending mail as your domain — often surprising, sometimes rogue.

How DMARC actually works

DMARC runs on every inbound email in a four-step check.

Example DMARC TXT record

What each tag means

• v=DMARC1 — protocol version (required first)
• p= — policy (none / quarantine / reject)
• rua= — where aggregate XML reports go
• ruf= — where forensic per-message reports go
• sp= — policy for subdomains
• adkim= / aspf= — strict (s) or relaxed (r) alignment
• pct= — percentage of failing mail the policy applies to

DMARC policies compared

Real DMARC rollout examples

Four common paths to a fully enforced DMARC posture.

1. Startup with one ESP

2. Enterprise with 20+ sending tools

A mid-size company discovers 22 tools sending as their domain in the first week of p=none reports: ATS, invoicing, CRM, sales engagement, ticketing, calendar tools. Each needs SPF/DKIM aligned before p=quarantine becomes safe. Timeline: 3-6 months.

3. Subdomain policy split

4. Marketing subdomain isolated

Common pattern: send bulk marketing from mkt.example.com with its own DKIM/SPF/DMARC so an email deliverability incident does not damage the sender reputation of the root domain used for transactional mail.

DMARC vs SPF vs DKIM — how they combine

DMARC is not a replacement for SPF or DKIM — it is the enforcement layer that ties them together. All three run on every email in a modern inbox.

7 best practices for DMARC rollout

1. Start at p=none. Deploying reject on day one blocks legitimate mail from tools you did not know were sending as you.
2. Use a DMARC report parser. Aggregate XML is dense — tools like Postmark DMARC, DMARC Digests, or Valimail turn it into a readable dashboard.
3. Fix unauthenticated senders one at a time. Every tool needs its own SPF include + DKIM setup + alignment fix.
4. Ramp with pct=. Move to quarantine at pct=10, then 25, 50, 100 before switching to reject.
5. Publish a subdomain policy (sp=). Otherwise attackers spoof invoices.example.com even after your root is locked down.
6. Prefer relaxed alignment (adkim=r, aspf=r). Strict alignment (s) breaks common patterns like mail from mail.example.com signed for example.com.
7. Never leave rua empty. Reports are the only way to catch drift when a new tool starts sending as you.

Common DMARC mistakes to avoid

• Publishing multiple DMARC records — only one is valid; duplicates invalidate DMARC entirely.
• Forgetting subdomains (sp=) — attackers use unprotected subdomains for phishing.
• Ignoring aggregate reports — drift starts within weeks of new tools being adopted.
• Setting strict alignment too early — breaks marketing tools that sign with subdomains.
• No plan to move past p=none — monitor mode gives zero anti-spoofing benefit.

How theStacc helps with DMARC

DMARC rollouts stall because report parsing is tedious and every misconfigured tool becomes a fire drill. theStacc audits your DMARC record, parses aggregate reports for every sending source, and delivers a ranked plan to move you from p=none to p=reject without breaking legitimate mail. You get a per-tool alignment checklist, a ramp schedule with pct= milestones, and monitoring so drift never surprises you.

Frequently asked questions

Related glossary terms

Sources

Akshay VR

Marketing Head · theStacc · ex-Sr Marketing Specialist, ARKA 360

Akshay leads editorial and content operations at theStacc. He writes about SEO craft, content operations, and the deliverability infrastructure that quietly decides whether marketing campaigns even land in the inbox.

LinkedIn Author page More terms by Akshay