Lion Group

DMARC

What is a DMARC record? How to read one, write one, and enforce it

Your DMARC record is a single line of DNS text that decides whether strangers can send email as your company. Here is what every tag means, how to read your own record in 60 seconds, and how to enforce it without breaking legitimate mail.

3 September 2026 · 7 min read

DMARC — Domain-based Message Authentication, Reporting and Conformance — is a single line of text published in your domain's DNS. Despite being one line, it answers an expensive question: when an email claims to come from your company, should the receiving server deliver it, quarantine it, or reject it outright?

Without DMARC, that decision is left to guesswork. Anyone on the internet can put your domain in the "From" field of an email — to your customers, your suppliers, or your own staff — and most receiving servers will deliver it. DMARC is how you take that decision back.

What a DMARC record actually looks like

A DMARC record lives at a DNS address built from your domain: _dmarc.yourdomain.com. It is a TXT record, and a real one looks like this:

It looks cryptic, but it is just a list of tag=value pairs separated by semicolons. Only two tags are mandatory — v and p. Everything else is tuning.

Every tag, in plain English

  • v=DMARC1 — the version. Always exactly this; it identifies the record as DMARC.
  • p= — the policy: what receivers should do with mail that fails authentication. none means "do nothing, just report" (monitoring mode). quarantine means "send failures to spam". reject means "refuse the message entirely". This is the tag that matters most.
  • sp= — the same policy, but for subdomains. If omitted, subdomains inherit the p= policy.
  • rua= — where to send aggregate reports: daily XML summaries from Gmail, Microsoft, Yahoo and others showing who sent mail as your domain and whether it passed.
  • ruf= — where to send forensic (per-message) failure reports. Rarely used today because many receivers no longer send them and they can contain personal data.
  • pct= — the percentage of failing mail the policy applies to. pct=25 with p=quarantine lets you enforce gradually: a quarter of failing mail is quarantined while you watch the rest.
  • adkim= and aspf= — alignment strictness for DKIM and SPF. r (relaxed, the default) allows subdomains of your domain to align; s (strict) requires an exact match.
  • fo= — which failures trigger forensic reports. fo=1 means any failure, not just a full SPF+DKIM failure.

How DMARC decides: SPF, DKIM, and the alignment test

DMARC itself does not authenticate anything. It sits on top of two older mechanisms and adds one crucial rule — alignment:

  • SPF lists which servers may send mail for your domain. It checks the technical envelope sender, not the "From" address the human sees.
  • DKIM adds a cryptographic signature to the message, tied to a domain chosen by the sender — again, not necessarily the visible "From" domain.
  • DMARC asks: did SPF or DKIM pass, AND does the domain they authenticated match the "From" domain the recipient actually sees? That match is alignment, and it is the whole point. A scammer can pass SPF and DKIM perfectly — for their own domain. They cannot align with yours unless you let them.

How to read your own record in 60 seconds

  1. Open any DMARC checker, or run: nslookup -type=TXT _dmarc.yourdomain.com (on Mac/Linux: dig TXT _dmarc.yourdomain.com).
  2. No record at all? Anyone can spoof your exact domain and nothing will stop it. This is the most common finding in our assessments.
  3. Record exists? Read the p= tag. p=none means you are only observing — spoofed mail is still delivered. Real protection starts at quarantine and is complete at reject.
  4. Check the rua= address. If reports go to an inbox nobody reads — or to a vendor you no longer use — you are flying blind about who sends as you.

The safe path from p=none to p=reject

The reason most domains stall at p=none is fear: flip to reject too early and you block your own invoicing tool, CRM, newsletter platform or helpdesk. The reports exist precisely to avoid that. The disciplined sequence:

  1. Publish p=none with a rua= address you actually monitor. This alone changes nothing about delivery — it just starts the data flowing.
  2. Read aggregate reports for 2–4 weeks. Map every legitimate sender: marketing platforms, billing systems, ticketing tools, payroll providers.
  3. Fix SPF and DKIM for each legitimate source until they pass with alignment. Third-party senders usually need a DKIM key configured in their console.
  4. Move to p=quarantine, optionally with pct=25 first, raising to 100 as reports stay clean.
  5. Move to p=reject. At this point, exact-domain spoofing of your brand is over — for every mailbox provider that checks DMARC, which is effectively all of the major ones.
  6. Don't forget parked and legacy domains. Domains you own but never send from should carry the strongest possible record: v=DMARC1; p=reject; with no mail services at all.

What DMARC does not stop

  • Lookalike domains — DMARC protects your exact domain, not liongr0up.io. That needs lookalike-domain monitoring.
  • Display-name spoofing — "CEO — Mobile" from a free Gmail address passes DMARC trivially, because it is genuinely sent by Gmail.
  • Compromised real mailboxes — a supplier's hacked account sends mail that is fully authenticated. Only behavioural, inbox-level detection catches this.

DMARC is the foundation, not the whole building. It removes exact-domain spoofing from the attacker's toolkit so the remaining layers — behavioural email security, verification processes, user training — have a much smaller problem to solve.

How Lion Group helps

Our DMARC management service runs this entire programme for you: report collection and analysis, sender inventory, SPF/DKIM remediation with your vendors, and a managed, staged path to p=reject — including the parked domains everyone forgets. You get enforcement without the risk of blocking your own invoices.

AA

Arik Assayag

Founder & CEO, Lion Group

Frequently asked questions

Is DMARC a one-time setup?

No. The record is one line, but every new SaaS tool that sends mail as you — marketing, billing, support — must be authenticated and aligned, or enforcing your policy will break it. DMARC is an ongoing discipline, which is why many organisations outsource the monitoring.

What's the difference between p=none, p=quarantine and p=reject?

p=none tells receivers to deliver everything and just send you reports — it is monitoring mode and provides no protection by itself. p=quarantine sends failing mail to spam. p=reject refuses it entirely, which is the only policy that fully stops exact-domain spoofing.

Do I need both SPF and DKIM for DMARC to pass?

No — DMARC passes if either SPF or DKIM passes AND is aligned with the visible From domain. In practice you want both: DKIM survives forwarding, which breaks SPF, so having only SPF makes your legitimate mail fragile.

Why am I receiving DMARC reports full of IP addresses I don't recognise?

That is normal and exactly what the reports are for. Most unfamiliar sources are forwarded mail or third-party services your own staff signed up for. Some are genuine spoofing attempts — which is what your policy is there to stop. A DMARC management service parses these XML reports into a readable sender inventory.

Will p=reject break my newsletters or invoicing platform?

Only if those senders are not authenticated and aligned — and that is exactly what the p=none monitoring period discovers. Fix SPF/DKIM alignment for each legitimate sender first, then enforce. Done in that order, enforcement breaks nothing.

Related