Glossary: deliverability
What is DMARC?
DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is a policy a domain owner publishes in DNS. It tells receiving servers what to do with email that fails SPF and DKIM checks for that domain, and where to send reports about it.
A DMARC record, part by part
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.example
- v=DMARC1
- Marks the record as DMARC
- p=quarantine
- Asks receivers to treat failing mail as suspicious
- rua=mailto:reports@yourdomain.example
- Says where to send the summary reports
DMARC has three parts.
DMARC builds on SPF and DKIM. A basic record reads v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.example. The first tag, v=DMARC1, marks the record as DMARC. The rest is a rule, a check and a way to hear what happened.
The policy says what to do with failures.
p=none asks for no action. p=quarantine asks receivers to treat failing mail as suspicious. p=reject asks them to refuse it.
Alignment links the checks to the From address.
A message passes DMARC when SPF or DKIM passes for a domain that matches the one in the visible From address.
Reports show who is sending as you.
The rua tag says where to send the summary reports, which list the servers that sent mail under your domain and how it fared.
Here is a DMARC rollout for an invented company.
Imagine Pennywhin, an invented scheduling software company. It publishes a record with p=none on its sending domain, so it can watch the reports and change nothing. The reports show three sources of mail: its mail host, which passes, its billing tool, which fails because DKIM was never set up, and an unknown server, which fails.
Pennywhin sets up DKIM for the billing tool and checks that the next reports show it passing. It then moves to p=quarantine, where failing mail is treated as suspicious, and later to p=reject, where failing mail is refused. Mail from the unknown server stops arriving, and Pennywhin's real mail is unaffected.
Pennywhin's DMARC policy in three stages
- p=noneWatch the reports, change nothing
- p=quarantineFailing mail is treated as suspicious
- p=rejectFailing mail is refused
Roll out DMARC in four steps.
Start by listening, then tighten. Moving straight to the strictest policy risks blocking your own mail.
The four steps in order
- 1Fix SPF and DKIM
- 2Start at none
- 3Read reports
- 4Tighten
- 1
Fix SPF and DKIM first.
DMARC relies on them. Check both on every service that sends for the domain.
- 2
Start at none.
Publish a record with p=none and a rua address so the reports reach you.
- 3
Read reports and fix what fails.
Find every legitimate sender that fails and set it up properly.
- 4
Tighten to quarantine, then reject.
Raise the policy once your own mail passes every time.
Prymatica sets up proper SPF, DKIM and DMARC settings on your sending domains and keeps those domains entirely separate from your primary domain. See how Prymatica's cold email process works.
Teams make these mistakes with DMARC.
The policy jumps straight to reject.
Without reading reports first, legitimate mail from a forgotten tool gets refused.
The record stays at none forever.
p=none collects reports and protects nothing. It is a starting point.
Nobody reads the reports.
The reports are the whole point of the first stage. Unread, they fix nothing.
These glossary terms sit next to DMARC.
Questions
People ask these questions about DMARC.
What does DMARC stand for?
Domain-based Message Authentication, Reporting and Conformance. It is a published standard that sits on top of SPF and DKIM.
Does email need to pass both SPF and DKIM for DMARC?
No. A message passes DMARC if at least one of them passes for a domain that aligns with the From address. Setting up both gives a second chance when one fails, for example after forwarding.
What is the difference between p=none, p=quarantine and p=reject?
p=none asks receivers to take no action and only report. p=quarantine asks them to treat failing mail as suspicious, which in practice means the spam folder. p=reject asks them to refuse failing mail outright.
Where is a DMARC record published?
As a TXT record in DNS at the name _dmarc followed by your domain, for example _dmarc.yourdomain.example.
Does DMARC improve deliverability?
It lets mailbox providers confirm that mail using your domain is really yours, which protects the domain's reputation from forgers. It does not make unwanted mail welcome: list quality and relevance still decide where a message lands.
Want your inbox filled with qualified leads?
Let's scale together. Book a free intro call and we'll show you exactly how we'll fill your pipeline with meetings from the industries you want to target.
No contracts. Start free. Cancel anytime.