DMARC
Domain-based Message Authentication — a DNS record telling receivers what to do when SPF or DKIM fails (allow, quarantine, or reject), and where to send reports about who is sending as your domain.
Domain-based Message Authentication — a DNS record telling receivers what to do when SPF or DKIM fails (allow, quarantine, or reject), and where to send reports about who is sending as your domain.
What DMARC decides
SPF and DKIM each authenticate something, but neither is tied to the address the reader sees. DMARC adds that tie. A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) the From domain. One is enough, not both.
Alignment is the part people miss. A sequencer that sends from its own domain can pass SPF for its domain and still fail DMARC for yours.
The record
DMARC is a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p— the policy:none(monitor),quarantine(spam folder), orreject.rua— where to send daily aggregate reports.sp— a different policy for subdomains, if you want one.adkim/aspf— relaxed (default) or strict alignment.
How to roll it out without losing mail
- Publish
p=nonewith aruaaddress and leave it for a couple of weeks. - Read the reports. They list every source sending as your domain, including ones you forgot.
- Fix SPF and DKIM for each legitimate sender.
- Move to
quarantine, thenreject, only once real mail is passing.
Going straight to reject is how a company's invoices start vanishing.
Why it matters for outbound
Gmail and Yahoo have required DMARC from bulk senders since 2024, at a minimum p=none. Cold-email volume per domain is usually far lower, but a published, aligned policy still helps. Generate one with the DMARC generator and see the full SPF/DKIM/DMARC explainer.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Publish as TXT at _dmarc.yourdomain.com. Start at p=none until SPF and DKIM pass on real mail.
Related
- SPF — cold email glossary
Sender Policy Framework — a DNS TXT record listing which servers are authorized to send mail for your domain. Mail from an unlisted server looks forged, whether it actually is or not.
- DKIM — cold email glossary
DomainKeys Identified Mail — a DNS record and cryptographic signature that proves an email was not altered in transit and actually came from your server.
- Cold email & deliverability glossary
Plain-language definitions for the terms that come up in cold outreach and email deliverability: bounce rate, catch-all, SPF/DKIM/DMARC, sender reputation, and more.
- Bounce rate — cold email glossary
The share of sent emails a mail server refuses to deliver. A hard bounce means the mailbox does not exist; a soft bounce means it is temporarily unreachable.