A message passes DMARC when at least one supported authentication method — SPF or DKIM — passes and its authenticated domain aligns with the domain visible in the From address.
The domain owner publishes a DNS record containing a requested policy such as p=none, p=quarantine, or p=reject. Reports help identify legitimate senders, configuration errors, and unauthorized use. Deployment normally begins with monitoring and moves toward enforcement after valid mail streams are authenticated and aligned.
Key points
SPF contributionSPF authenticates the MAIL FROM domain against an authorized sending system; DMARC then checks its alignment with the visible From domain.
DKIM contributionDKIM validates a cryptographic signature and its signing domain; DMARC then checks that domain’s alignment with the visible From domain.
Policy roleTells receivers the domain owner’s requested treatment for mail that fails; final handling remains with the receiver.
Important limitationDMARC does not encrypt mail, judge message content, authenticate a human author, or stop abuse of lookalike domains and compromised legitimate accounts.