Policy levels: none, quarantine, reject
Checks built on: SPF and DKIM
The destination that stops spoofing
The policy that turns checks into protection
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. On their own, SPF and DKIM can tell a receiver whether a message passed a check, but they don’t say what to do about a failure, and they don’t tell you anything. DMARC fills both gaps.
It’s a single policy record in your DNS that does two jobs at once. First, it tells receiving servers how to treat mail claiming to be from you that fails authentication: monitor it, send it to spam, or block it outright. Second, it asks those receivers to send you reports on everything they saw, which is the only real window you get into who is sending as your domain, from where, and whether they pass.
A real record, broken down
v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
v=DMARC1: marks it as a DMARC recordp=: your policy:none,quarantineorrejectrua=: where to send the aggregate summary reportsruf=: where to send failure reports on individual messages
Alignment: the clever bit that stops fakes
A message can pass SPF or DKIM and still be a fake, because those checks can be satisfied by a domain that isn’t the one your recipient actually sees. DMARC closes that loophole with alignment. It insists that the domain which passed SPF or DKIM matches the visible “From” address, the name the human reading the email actually trusts. No alignment, no DMARC pass.
It only takes one
DMARC passes if either SPF or DKIM passes and aligns with the From address. That redundancy is why having both matters: if one breaks in transit, the other can still carry the message.
Why a pass isn’t enough
An attacker can make mail pass SPF for their own domain. Without alignment, that would count. With it, the pass is worthless to them unless they also control your From domain, which they don’t.
What the receiver sees
If a message fails alignment, the receiver applies your policy (none, quarantine or reject) and records the outcome in the reports it sends back to you.
none, quarantine, reject, and why none protects nothing
Your policy is a single instruction to every receiver in the world. p=none means “watch and report, but deliver everything anyway”. It’s monitoring only, and it protects nothing. A great many domains turn DMARC on at none, see the reports start flowing, and mistake that for being protected. They aren’t: a spoofer’s mail still sails through.
p=quarantine tells receivers to send failing mail to the spam folder. p=reject tells them to block it outright, so it never reaches the recipient at all. Reject is the only level that truly stops impersonation: everything before it is a step on the way there.
p=none: monitor only, delivers everything, protects nothingp=quarantine: failing mail goes to spamp=reject: failing mail is blocked outrightrua: aggregate reports, the big-picture summary of all sendersruf: failure reports, detail on individual failed messages
The journey from none to reject
The whole point of DMARC is to reach reject safely. The danger is going too fast or too slow. Jump straight to reject before you’ve found every legitimate sender and you’ll block your own invoices and newsletters. Sit at none forever and the door stays wide open. The safe path is to start at none, read the reports, fix and authorise every real sender, then tighten step by step, and that reading, week after week, is the real work.
How DMARCER does the heavy lifting
DMARC reports arrive as dense XML that’s all but unreadable by hand. DMARCER turns them into a plain-English picture, and goes further: it gives a clear verdict on every report, independently re-checking SPF, DKIM and alignment so you know whether a failure is an attacker spoofing you, a real sender you forgot to set up, or a harmless false alarm.
From there it runs a guided enforcement journey: showing you exactly which senders still need fixing before each step, so you can move from none to quarantine to reject with confidence that you won’t block a single piece of your own legitimate mail.
- Raw XML reports turned into a readable picture of every sender
- A clear verdict on every report: spoofing, real sender, or false alarm
- Independent re-check of SPF, DKIM and alignment
- A guided journey from
nonetoreject, one safe step at a time - Knows which senders must be fixed before each step
Keep exploring
Forensic analysis →
A plain-English verdict on every DMARC report you get.
Enforcement journey →
The guided path from monitoring to full reject, done safely.
DMARC checker →
Check your DMARC record and policy in seconds, free.
See who’s really sending as you
Run a free check to see your DMARC policy today, then let DMARCER guide you safely all the way to reject.
Check your domain