What is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It lets you publish a policy telling receiving servers what to do with mail that fails authentication — and asks them to send you reports — so you can lock down who is allowed to send as your domain.

How DMARC works

You publish a policy as a DNS TXT record:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com"

The key part is the policy: p=none (monitor only), p=quarantine (send to spam), or p=reject (block). DMARC also requires alignment — the domain in the From: header must match the domain that passed SPF or DKIM, not just any domain.

Why it matters

DMARC is what actually stops attackers spoofing your From: address, and mailbox providers increasingly require it. Misaligned DMARC is a frequent cause of mail landing in spam. When you send a real message to a Devmailr inbox, the DMARC verdict comes back on the received email, so you can assert it passes in your pipeline — see testing SPF, DKIM, and DMARC.