What it means
DMARC tells receivers how to compare the Author Domain, the domain in the visible From, with a domain that SPF or DKIM has already authenticated. The domain owner publishes a DNS TXT record at _dmarc. That record states a handling preference for failures and can request reports. The version tag remains v=DMARC1.
The current specification is RFC 9989, a Proposed Standard from May 2026. It obsoletes RFC 7489 and RFC 9091. RFC 7489 is a historical predecessor, not the text to operate from. Aggregate reports are specified in RFC 9990, and failure reports in RFC 9991, both May 2026. A pass means the Author Domain’s use on that message was authorized. RFC 9989 says that authorization is not a claim that the message is safe or that the domain owner is virtuous. p=none, with reports, is the monitoring start. Quarantine or reject comes after legitimate mail is aligned.
See the idea / Email
One aligned pass is enough.
The receiver has SPF and DKIM results. DMARC needs a passing result whose domain aligns with the visible From.
Two illustrative messages use From finance@chronos.orbital. A valid record at _dmarc.chronos.orbital sets strict alignment for both mechanisms: v=DMARC1; p=none; aspf=s; adkim=s.
01 / 04
Inputs
From finance@chronos.orbital is the name a reader sees. Here SPF has failed, while DKIM passed for chronos.orbital. DMARC still needs alignment.
More about this step
The receiver has already performed SPF and DKIM checks. Their results remain visible and are not rerun by this diagram. A failed SPF result cannot supply an authenticated identifier for DMARC, so its condition is already No.
Step through at your own pace.
Keep in mindA DMARC result concerns domain use, not message safety. Strict alignment, one DKIM signature, and a valid policy; handling and reports omitted.
Read the visual, step by step
- Inputs. From finance@chronos.orbital is the name a reader sees. Here SPF has failed, while DKIM passed for chronos.orbital. DMARC still needs alignment. The receiver has already performed SPF and DKIM checks. Their results remain visible and are not rerun by this diagram. A failed SPF result cannot supply an authenticated identifier for DMARC, so its condition is already No.
- Match. The receiver compares the passing DKIM domain with From under strict alignment. The names match exactly. The failed SPF result cannot satisfy DMARC. Strict alignment requires an exact domain-name match, ignoring case. Relaxed alignment instead compares organizational domains. The guides in the drawing represent inputs to this receiver check, not SMTP or DNS packets.
- One pass. DKIM passed and its domain matches From, so DMARC passes. SPF’s failure does not undo that aligned DKIM pass. At least one aligned authenticated identifier satisfies DMARC; both mechanisms do not have to pass. With this valid policy, the receiver completes the DMARC result only after establishing that condition.
- New mail. Compare another message with From unchanged: SPF and DKIM both pass for other.example. Neither matches chronos.orbital, so DMARC fails. This is a new message, not a reversal of the earlier pass. Both passing authentication checks remain true; neither supplies an aligned identifier. The p=none policy offers no handling preference. Delivery is the receiver’s separate decision; policy discovery and reporting are omitted.
A DMARC result concerns domain use, not message safety. Strict alignment, one DKIM signature, and a valid policy; handling and reports omitted.
Flow references: RFC 9989: alignment and DMARC evaluation
AN ILLUSTRATIVE SCENARIO
Meridian Mail starts in monitoring mode
Vera publishes v=DMARC1; p=none and an aggregate-report address for chronos.orbital. The first reports show a payroll vendor whose SPF passes on a different organizational domain, so DMARC fails even though the vendor is real. She aligns that stream with DKIM before anyone discusses p=reject. A later pass on a wire request still sends Sloane to a callback, because a pass is not payment approval.
Put it to work
- Inventory senders, publish SPF, and sign with DKIM that aligns to the Author Domain before you publish a handling preference stronger than monitoring.
- Publish p=none with an rua destination, read aggregate reports, and repair unaligned legitimate mail. Treat unread reports as an unfinished control.
- Consider quarantine or reject only after that review. Remember that p=reject does not stop cousin domains or a compromised mailbox that is allowed to send.
_dmarc.chronos.orbital TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@chronos.orbital"How to check your work
Look up the public _dmarc TXT for one domain you are allowed to name. Say whether the policy is none, quarantine, or reject. Do not paste employer report contents into a shared system.
Connect the ideas
- SPF
A DNS policy that says which hosts may use a domain in the MAIL FROM or HELO identity. A pass authorizes that host for that identity. It does not prove the visible From address or a person’s intent.
- DKIM
A signature that lets a domain claim responsibility for selected message content, checked with a public key in DNS. A valid signature ties that signing domain to the signed bytes. It does not prove a human wrote the display name.
- Identifier alignment
The DMARC check that the Author Domain in the visible From matches an SPF- or DKIM-authenticated domain. Relaxed alignment shares an organizational domain. Strict alignment requires the names to be identical.
- Phishing
Social engineering that tricks a person into revealing authenticators or approving a transaction they did not intend.