DMARC configuration

DMARC Record Explained

A DMARC record is a DNS TXT record published at a name such as _dmarc.example.com. It declares the DMARC version, policy and optional reporting or alignment settings for a domain.

The record is public, so external systems can read it without access to your mail server or DNS account.

Run the free website security check

Core DMARC record tags

A DMARC record begins with v=DMARC1 and includes a policy tag. The policy value is commonly p=none, p=quarantine or p=reject. Additional tags can define report destinations and alignment preferences.

v=DMARC1 identifies the record as DMARC.
p=none requests monitoring without enforcement.
p=quarantine asks receivers to treat failing mail with suspicion, often by placing it in spam or junk.
p=reject asks receivers to reject messages that fail DMARC, subject to the receiver's own handling.
rua can specify where aggregate DMARC reports should be sent.

Alignment settings

The optional adkim and aspf tags influence strict or relaxed alignment for DKIM and SPF. Alignment is about the relationship between authenticated domains and the domain visible in the From address.

A DMARC pass can come from aligned SPF OR aligned DKIM. The policy should not be designed on the assumption that both mechanisms must pass every message.

A safer path toward enforcement

Publishing p=reject immediately can disrupt legitimate mail if authorised third-party senders are missing SPF authorisation, DKIM signing or alignment. A staged rollout starts by understanding the sending inventory and authentication results.

After legitimate senders have been validated and gaps corrected, policy can be tightened deliberately. The appropriate rollout depends on the domain's mail ecosystem and business tolerance for delivery risk.

Public record, private change control

Anyone can inspect the published DMARC record, but only authorised administrators should change it. A security scan can identify public policy signals; it cannot know every legitimate sender or safely make DNS changes on the domain owner's behalf.

Check the live public DNS record

Use the matching ScoutLab checker with only a domain name. No signup or email address is required.

Free DMARC checkerLook up the live DMARC policy published in public DNS.

Check your public email-authentication signals

ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.

Run the free website security check

Keep reading

SPF, DKIM and DMARC explainedSee how the three email-authentication layers work together.

What is DMARC?Start with alignment and policy basics.

DMARC policy not enabledUnderstand why p=none is commonly flagged.

Frequently asked questions

Where is a DMARC record published?

A DMARC policy is published as a DNS TXT record beneath the _dmarc label for the domain, for example _dmarc.example.com. Receiving mail systems query that public DNS location when evaluating DMARC.

What is the difference between p=none, p=quarantine and p=reject?

p=none is a monitoring policy, p=quarantine asks receivers to treat failing mail suspiciously, and p=reject asks receivers to reject failing mail. Moving to enforcement should follow validation of legitimate senders and authentication alignment.

Does p=reject guarantee nobody can spoof my business?

No. Strong DMARC enforcement reduces direct spoofing of the protected domain, but it does not prevent lookalike domains, compromised accounts or every form of impersonation. Receiver behaviour can also vary.

Technical references

SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.