What it means
DMARC tells receivers how to compare the Author Domain, the domain in the visible From, with a domain that SPF or DKIM has already authenticated. The domain owner publishes a DNS TXT record at _dmarc. That record states a handling preference for failures and can request reports. The version tag remains v=DMARC1.
The current specification is RFC 9989, a Proposed Standard from May 2026. It obsoletes RFC 7489 and RFC 9091. RFC 7489 is a historical predecessor, not the text to operate from. Aggregate reports are specified in RFC 9990, and failure reports in RFC 9991, both May 2026. A pass means the Author Domain’s use on that message was authorized. RFC 9989 says that authorization is not a claim that the message is safe or that the domain owner is virtuous. p=none, with reports, is the monitoring start. Quarantine or reject comes after legitimate mail is aligned.
AN ILLUSTRATIVE SCENARIO
Harbor Mail starts in monitoring mode
Maya publishes v=DMARC1; p=none and an aggregate-report address for harbor.example. The first reports show a payroll vendor whose SPF passes on a different organizational domain, so DMARC fails even though the vendor is real. She aligns that stream with DKIM before anyone discusses p=reject. A later pass on a wire request still sends Sam to a callback, because a pass is not payment approval.
Put it to work
- Inventory senders, publish SPF, and sign with DKIM that aligns to the Author Domain before you publish a handling preference stronger than monitoring.
- Publish p=none with an rua destination, read aggregate reports, and repair unaligned legitimate mail. Treat unread reports as an unfinished control.
- Consider quarantine or reject only after that review. Remember that p=reject does not stop cousin domains or a compromised mailbox that is allowed to send.
_dmarc.harbor.example TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@harbor.example"How to check your work
Look up the public _dmarc TXT for one domain you are allowed to name. Say whether the policy is none, quarantine, or reject. Do not paste employer report contents into a shared system.
Connect the ideas
- SPF
A DNS policy that says which hosts may use a domain in the MAIL FROM or HELO identity. A pass authorizes that host for that identity. It does not prove the visible From address or a person’s intent.
- DKIM
A signature that lets a domain claim responsibility for selected message content, checked with a public key in DNS. A valid signature ties that signing domain to the signed bytes. It does not prove a human wrote the display name.
- Identifier alignment
The DMARC check that the Author Domain in the visible From matches an SPF- or DKIM-authenticated domain. Relaxed alignment shares an organizational domain. Strict alignment requires the names to be identical.
- Phishing
Social engineering that tricks a person into revealing authenticators or approving a transaction they did not intend.