Short answer

DMARC builds on SPF, DKIM and alignment with the From domain. The policy can be none, quarantine or reject.

Policies

p=none collects reports without stopping mail. p=quarantine marks suspicious mail. p=reject asks receivers to reject.

Reports

rua addresses can receive aggregate reports showing which systems send email for the domain.

Deployment

Often start with p=none, analyze legitimate senders and then tighten the policy when SPF and DKIM are correct.

Common questions

Does DMARC need SPF and DKIM?

DMARC uses SPF and DKIM. At least one method needs to pass with alignment for DMARC to pass.

Is p=none useless?

No, p=none is useful for inventory and reporting before strict policy.

More guides