DMARC

Domain owners publish DMARC preferences as DNS TXT records in a subdomain named _dmarc. The owner of example.com publishes at _dmarc.example.com. A receiver that wants the policy for a From domain of example.com queries that same name.

The v and p tags have to be present on a policy record. p takes none, quarantine, or reject. none asks for no specific action on delivery. quarantine asks receivers to treat a failure as suspicious. reject asks them to reject during the SMTP transaction.

DMARC authenticates use of the From domain by requiring it to match an authenticated identifier. SPF can authenticate the MAIL FROM domain. DKIM authenticates the domain in the d= tag. Those domains are often not the one the reader sees.

Relaxed mode compares organizational domains. A DKIM d= of example.com aligns with a From address at news.example.com. Strict mode requires an exact match, and that same pair fails. A d= of com does not align, because com is not an organizational domain.

One message can carry several DKIM signatures. A DMARC pass needs any one of them to verify and to be aligned.

A receiver should make a best effort to follow the published policy when a message fails DMARC. It may deviate, and it should report the fact and the reason to the domain owner through the aggregate report's PolicyOverride.

DMARC does not authenticate a message on its own. Identifier alignment cannot happen if SPF and DKIM did not produce an aligned pass.