SPF and DKIM each answer a narrow technical question — was this sent from an authorized server, was this message altered in transit. Neither one, alone, tells a receiving mail server what to actually do when a message fails. DMARC is the policy layer that answers that: reject it, quarantine it, or just watch it happen.
How DMARC Actually Works
A domain publishes a DMARC record as a TXT record at _dmarc.<domain>. When mail claiming to be from that domain arrives, the receiving server checks whether it aligns with SPF and/or DKIM — not just whether either check individually passes, but whether the domain in the visible "From" header actually matches the domain those checks validated. If it doesn't align with either, DMARC's policy tag decides what happens next.
The Policy Tag: none, quarantine, reject
- none — monitor only. Failing mail is still delivered normally; the domain owner just receives reports about it. This is the standard starting point, used to confirm every legitimate mail source is correctly configured before tightening enforcement.
- quarantine — failing mail is routed to spam/junk instead of the inbox, rather than delivered normally.
- reject — failing mail is refused outright by the receiving server. The strongest setting, and the end goal for a domain serious about stopping spoofing.
A domain that never moves past none isn't actually blocking anything — it's only watching. That's a legitimate rollout stage, not a finished configuration.
The Other Tags Worth Knowing
- sp — a separate policy specifically for subdomains, when it should differ from the main domain's.
- pct — applies the policy to only a percentage of mail, used to roll out enforcement gradually instead of all at once.
- rua — where aggregate reports are sent: a regular summary of which servers send mail on the domain's behalf, and whether it passed or failed.
- ruf — where forensic (per-message) reports are sent, when configured; far less commonly used than
rua.
Why It Depends on SPF and DKIM
DMARC has nothing to grade without at least one of SPF or DKIM actually passing and aligning with the visible From domain. A domain with a strict DMARC policy but no working SPF or DKIM is enforcing against a check that never succeeds in the first place — worth confirming both are actually in place before assuming DMARC alone covers mail authentication.
Frequently Asked Questions
Is a policy of "none" useless?
Not useless — it's the deliberate first step. It provides visibility into what would happen under enforcement without any risk of blocking legitimate mail that isn't yet correctly configured. The mistake is stopping there indefinitely rather than moving to quarantine or reject once the reports confirm nothing legitimate would be affected.
My domain has no DMARC record — how much of a problem is that?
It means mail spoofing this domain's name faces no enforcement at all, regardless of how well SPF and DKIM are configured — DMARC is what actually acts on their results. It's a common gap even on otherwise well-configured domains, since SPF and DKIM alone are enough for a domain's own mail to deliver normally.
What's the difference between DMARC alignment and SPF/DKIM passing?
SPF and DKIM can each pass on their own for a domain that doesn't match what a recipient actually sees in the From header — a common trick in spoofing. Alignment specifically checks that the domain those checks validated matches the visible sender, which is what actually makes DMARC meaningful rather than redundant with the two checks underneath it.
Check any domain's DMARC policy with the DMARC Checker.