The decision DMARC makes

A receiver evaluates SPF and DKIM, then asks whether at least one passing identifier aligns with the domain visible to the recipient. If neither route produces alignment, DMARC fails.

  • SPF authenticates an SMTP identity and sending IP.
  • DKIM authenticates a signed domain and selected message content.
  • DMARC adds alignment with the visible From domain, policy and reporting.

Policy is an instruction, not a guarantee

The domain publishes none, quarantine or reject. Receivers apply local handling and may consider other evidence. A p=none policy still produces useful reporting when rua is present.

v=DMARC1; p=none; rua=mailto:reports@example.com

What DMARC does not prove

  • That the human author is trustworthy.
  • That message content is safe or accurate.
  • That every receiver will send reports.
  • That every passing source was intentionally authorised by the domain owner.

Current standards

The DMARC base specification is RFC 9989 and aggregate reporting is RFC 9990. These replaced the original combined DMARC document, RFC 7489.

Further readingDMARC — RFC 9989DMARC aggregate reporting — RFC 9990