# DMARC

DMARC (RFC 7489) is a DNS policy at _dmarc.<domain> telling receivers what to do with mail that fails SPF and DKIM alignment — none, quarantine or reject — and where to send reports.

Date: 2026-09-13

Updated: 2026-10-08

DMARC, Domain-based Message Authentication, Reporting and Conformance, is the policy of RFC 7489 that a domain publishes as a TXT record at `_dmarc.<domain>` to tell receivers what to do with a message that fails both SPF and DKIM alignment with the visible sender — `p=none` to only report, `p=quarantine` to filter, `p=reject` to refuse — and where to send the aggregate reports that show who is sending as the domain.

## What Spaw answers

Every email answer carries `dmarc_policy`; the domain endpoint adds `dmarc_pct`, the share of failing mail the policy applies to (100 when the tag is absent), and `dmarc_rua`, whether a reporting address is published. A reject or quarantine policy raises `mailbox_confidence` on a catch-all domain, because an administered domain is likelier to hold the mailbox than a squat; a relay alias is the exception, since the policy describes the relay operator, not the alias.

## What it does not mean

A policy of none is a maintained domain that has not finished the rollout, not an unauthenticated one, and a reject policy says nothing about whether a particular mailbox exists. DMARC is about who may use the name, never about who reads the mail.

Reference: https://spaw.co/glossary/dmarc