DMARC connects SPF and DKIM to the address recipients actually see in the From field, and tells receiving servers what to do with messages that fail. It also sends you reports on who is sending mail as your domain. This article covers the record's tags, alignment, and how to roll out DMARC without losing legitimate mail.
The problem DMARC solves
SPF checks the domain in the envelope address (Return-Path), and DKIM checks the domain in the signature's d= tag. Neither one, on its own, checks the From address a person reads. A scammer can send from their own domain with valid SPF and still put director@example.uz in the From field.
DMARC requires at least one of those checks to pass and its domain to match the From domain. That match is called alignment.
Alignment: adkim and aspf
A message passes DMARC if at least one of these is true:
- SPF passes, and the Return-Path domain aligns with the From domain;
- DKIM passes, and the
d=domain aligns with the From domain.
The alignment mode is set with aspf (for SPF) and adkim (for DKIM):
| Mode | Meaning | Example for From: example.uz |
|---|---|---|
r (relaxed, default) | The organizational domain must match | d=mail.example.uz — aligned |
s (strict) | The domains must match exactly | d=mail.example.uz — not aligned |
The default relaxed mode works for most companies. Strict mode only makes sense if you know every source sends with the exact domain.
A classic case: a newsletter service passes SPF, but for its own domain, not yours. SPF says pass, yet DMARC fails because nothing aligns. The fix is to set up DKIM signing in that service with d=example.uz.
The DMARC record and its tags
DMARC is published as a TXT record on the _dmarc subdomain:
_dmarc.example.uz. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.uz"| Tag | Values | Purpose |
|---|---|---|
v | DMARC1 | Version; required and must come first |
p | none, quarantine, reject | Policy for the domain; required |
sp | same | Policy for subdomains; defaults to p |
pct | 0–100, default 100 | Share of failing messages the policy applies to |
rua | mailto: addresses | Where to send aggregate reports |
ruf | mailto: addresses | Per-message failure reports; most large providers don't send them |
adkim, aspf | r or s | Alignment mode |
fo | 0, 1, d, s | When to generate failure reports |
Policies
p=none— monitoring only: mail is delivered as usual and you receive reports.p=quarantine— failing messages go to spam or quarantine.p=reject— failing messages are rejected at the door.
A policy is a request, not an order. Major mailbox providers honor it, but the final decision is up to the receiver.
rua reports
Aggregate reports are XML files (usually compressed) that receivers typically send once a day. They show which IP addresses sent mail using your domain, how many messages, whether they passed SPF and DKIM, and whether they aligned.
- Use a dedicated mailbox or alias for reports, such as
dmarc@example.uz; a busy domain can get a lot of them. - Raw XML is tedious to read, so use a DMARC report analyzer, either a service or a tool. MCMail offers a paid Domain Monitor service for this: it presents DMARC reports in plain language, checks SPF, DKIM, DMARC, and MX daily, looks for your domain on blocklists, and sends alerts to Telegram.
- If reports go to an address on a different domain, that domain must authorize it with a record like
example.uz._report._dmarc.reports.examplecontaining"v=DMARC1". Without it, receivers won't send reports there.
You'll likely discover senders you didn't know about: the website, the CRM, accounting software, newsletters. Each one either needs proper setup (SPF and DKIM with alignment) or should stop sending as your domain.
Rolling out DMARC step by step
- Prepare. Make sure SPF and DKIM are configured and passing for your main mail.
- Monitor. Publish
p=nonewithruaand collect reports for 2–4 weeks. - Fix. Get every legitimate source passing DMARC.
- Partial quarantine. Move to
p=quarantine; pct=25, then raisepctto 50 and 100 while watching the reports and any complaints from colleagues. - Reject. Once no legitimate mail is failing, set
p=reject.
Step 2: "v=DMARC1; p=none; rua=mailto:dmarc@example.uz"
Step 4: "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.uz"
Step 5: "v=DMARC1; p=reject; rua=mailto:dmarc@example.uz"Keep in mind that receivers apply pct only approximately, and the revised version of the standard (DMARCbis) proposes replacing it with a t flag. Don't linger on intermediate values for too long.
Don't jump straight to p=reject. If some service sends mail as your domain without alignment, those messages will stop arriving, and you'll only find out when customers complain.
Common mistakes
- Wrong record name: DMARC belongs on
_dmarc.example.uz, not on the domain itself. - Two DMARC records: just like SPF, there must be only one, or DMARC is ignored.
- Syntax errors: tags are separated by semicolons, and
ruaaddresses need themailto:prefix. - Forgotten subdomains: if subdomains don't send mail, add
sp=reject. - Staying on none forever:
p=nonedoesn't protect anything; it's only the observation phase.
Several major mailbox providers now require DMARC from bulk senders, and even for a small company it noticeably reduces spoofing and spam-folder problems. With MCMail, we set up SPF, DKIM, and DMARC for your domain. For other causes of delivery trouble, see why emails go to spam.