--- title: "DMARC: definition, record parts and rollout" url: "https://coldmeetings.com/glossary/dmarc.md" canonical_url: "https://coldmeetings.com/glossary/dmarc" last_updated: "2026-10-20" type: "conceptual" summary: "DMARC sets the handling for messages that do not align under SPF and DKIM, and sends you reports. See the record parts and a safe rollout." related: ["https://coldmeetings.com/glossary/spf.md", "https://coldmeetings.com/glossary/dkim.md", "https://coldmeetings.com/glossary/sender-reputation.md"] --- # DMARC: definition, record parts and rollout > **For AI agents:** the complete index of ColdMeetings pages is [llms.txt](https://coldmeetings.com/llms.txt). Every page is also served as markdown at its URL plus .md. DMARC sets the handling for messages that do not align under SPF and DKIM, and sends you reports. See the record parts and a safe rollout. **What is DMARC?** A DMARC policy is a DNS record you publish for your domain. It names what receiving servers should do with a message that claims your domain but fails the SPF and DKIM checks, and where they should send reports on what they saw. Group: 4. Deliverability. ## The parts 1. **Alignment is the test**: DMARC passes when SPF or DKIM passes and the domain it checked lines up with the domain in the visible From address. 2. **The policy is a request**: p= takes none, quarantine or reject. None asks for no special action, quarantine asks receivers to treat failures as suspicious, reject asks them to refuse the mail. 3. **Reports show what is happening**: The rua tag names an address that receives aggregate reports, so you see which servers send as your domain and whether they pass. 4. **It lives at _dmarc**: The record is a TXT entry at _dmarc.yourdomain, one per domain. ## A rollout at tallowcreek-mail.example Tallow Creek Robotics is invented. It starts with a monitoring record, reads the reports, then tightens the policy in steps. 1. Stage one, p=none: publish v=DMARC1; p=none; rua=mailto:dmarc@tallowcreek-mail.example and read the aggregate reports. Mail receivers asked for no action while the company learns who sends as its domain. 2. The first report covers 4,200 messages. 4,158 passed with alignment, which is 99%. The 42 that failed are traced to one forgotten sending tool, which is then fixed. 3. Stage two, p=quarantine: once the reports show only expected failures, change the policy so receivers treat the rest as suspicious. The pct tag can apply it to a share of mail first. 4. Stage three, p=reject: when quarantine shows no surprises, ask receivers to refuse mail that fails alignment. The starting record for tallowcreek-mail.example, broken into parts. ColdMeetings lists p=none as the starting record. | Part | Value | What it means | | --- | --- | --- | | Name | _dmarc.tallowcreek-mail.example | Where the TXT record lives. | | v | DMARC1 | The version tag. It has to read DMARC1 for receivers to treat the record as a policy. | | p | none | Policy: ask for no special action while you watch. | | rua | mailto:dmarc@tallowcreek-mail.example | Address that receives aggregate reports. | ## How to apply it 1. Make sure SPF and DKIM both pass for every service that sends as the domain. 2. Publish a p=none record with an rua address and read the reports for a few weeks. 3. Fix any legitimate sender that fails alignment, then move to p=quarantine. 4. Move to p=reject once quarantine runs without surprises, and keep reading the reports. ## Common mistakes - Jumping straight to p=reject before the reports show who sends as the domain. - Publishing a record with no rua address, so nothing is reported back. - Forgetting subdomains and the tools that send from them. ## Related terms - [SPF](https://coldmeetings.com/glossary/spf.md): SPF, short for Sender Policy Framework, is a DNS TXT record on your domain that lists the servers allowed to send mail using that domain. - [DKIM](https://coldmeetings.com/glossary/dkim.md): DKIM, short for DomainKeys Identified Mail, signs each outgoing message with a private key held by the sender. - [Sender reputation](https://coldmeetings.com/glossary/sender-reputation.md): Sender reputation is the running record a mailbox provider keeps about a sending domain or address, built from how recipients and receiving systems treated its past mail. ## Keep reading - [Domains and inboxes](https://coldmeetings.com/product/domains-and-inboxes.md) - [Email deliverability guide](https://coldmeetings.com/blog/email-deliverability-guide.md) - [Safe sending](https://coldmeetings.com/product/safe-sending.md) ## Questions ### Is DMARC required? Yahoo asks bulk senders to publish a valid DMARC policy of at least p=none and have DMARC pass. Google asks senders of 5,000 or more messages a day to set up DMARC with alignment. ### Does p=none protect my domain? Not by itself. It requests no action and gives you reports. Protection comes when you move to quarantine or reject. ### Where do the reports go? To the address in the rua tag. They are machine-readable summaries, so many teams read them through a reporting tool. ### Does the one-click unsubscribe standard relate to DMARC? They are separate. RFC 8058 covers the List-Unsubscribe headers that let a person leave a list in one step; DMARC covers who may send as your domain. ## Sources - RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC): https://www.rfc-editor.org/rfc/rfc7489, read 2026-10-19 - RFC 8058: Signaling One-Click Functionality for List Email Headers: https://www.rfc-editor.org/rfc/rfc8058, read 2026-10-19 - Google: Email sender guidelines: https://support.google.com/a/answer/81126, read 2026-10-19 - Yahoo: Sender best practices: https://senders.yahooinc.com/best-practices/, read 2026-10-19 Questions about outbound for your own company? Email hello@coldmeetings.com. ## Related - [SPF: definition, record format and example](https://coldmeetings.com/glossary/spf.md) - [DKIM: definition, record format and example](https://coldmeetings.com/glossary/dkim.md) - [Sender reputation: what shapes it](https://coldmeetings.com/glossary/sender-reputation.md)