How DMARC works
When a message arrives, the server runs the SPF and DKIM checks and then compares the result against the domain's DMARC policy. The policy sets one of three actions: p=none — only monitor, p=quarantine — move to spam, p=reject — refuse the message. It also names an address where aggregate reports about the checks should be sent.
Why DMARC matters
DMARC closes the gap that SPF and DKIM leave on their own:
- Alignment — it requires the domain in the From address to match the domain verified by SPF or DKIM.
- Control — the domain owner decides how strictly forged mail is rejected.
- Reporting — regular reports reveal who is sending mail on behalf of the domain.
This protects the domain from spoofing and phishing, while all legitimate mail keeps arriving through the configured MX records.
