What is DMARC?
DMARC is a DNS record that tells mail servers what to do with email that claims to be from your domain but fails SPF or DKIM. It is a TXT record at _dmarc.yourdomain and the policy can be p=none (monitor), p=quarantine (spam folder) or p=reject (refuse).
How DMARC works
When an email arrives, the receiver checks whether it passes SPF or DKIM and whether that domain matches the domain in the From line the recipient sees. If either passes with a matching domain, DMARC passes.
If the email fails, the policy in your DMARC record decides what happens: nothing, spam folder or rejection.
The three policies
p=none: monitoring. No email is blocked. A safe first stage.
p=quarantine: email that fails goes to spam.
p=reject: email that fails is refused. This is the goal.
_dmarcValuev=DMARC1; p=none;Why it matters now
Without DMARC anyone can send email that looks like it comes from your domain, such as fake invoices. Google and Microsoft (Outlook.com) also require SPF, DKIM and DMARC from senders of more than 5,000 messages a day to their users.
Common questions
What does p=none mean?
That DMARC is in monitoring mode: mail servers should not block anything. It does not stop spoofing, but it is a safe first stage before tightening to p=quarantine and p=reject.
Do I need DMARC reports (rua)?
Not to start. Reports are XML files mail servers send to an address you choose. They show who sends as your domain and can be added later with rua=mailto:address.
Can DMARC block legitimate email?
Yes, if p=quarantine or p=reject is set before every service that sends as your domain passes SPF or DKIM. That is why you start at p=none and test before tightening.