What is DMARC?
DMARC connects visible Header From with SPF and DKIM alignment, then publishes handling and reporting guidance.
Policy
p=none monitors, p=quarantine asks receivers to treat failing mail as suspicious, and p=reject asks compliant receivers to reject it. The receiver makes the final decision.
Control tags
sp controls subdomains; pct rolls policy out; rua receives aggregate reports; ruf receives failure reports; aspf and adkim select relaxed or strict alignment.
Safe rollout
Inventory legitimate senders, publish p=none, analyze reports, fix alignment, then increase pct and enforce gradually.
How DMARC reaches a decision
| SPF | DKIM | Alignment with From | DMARC |
|---|---|---|---|
| PASS | — | SPF aligns | PASS |
| FAIL | PASS | DKIM aligns | PASS |
| PASS | PASS | Neither aligns | FAIL |
| FAIL | FAIL | — | FAIL |
One aligned PASS is enough. DMARC does not require SPF and DKIM to pass together.
What the policy means
| Запись | What happens to DMARC FAIL | Practical meaning |
|---|---|---|
p=none | Reports; no enforcement | Monitoring |
p=quarantine | Ask for cautious handling | Partial protection |
p=reject; pct=100 | Ask for rejection | Strong published protection |
pct=0 | Do not apply policy | Monitoring, even with p=reject |