DMARC
A policy you publish in DNS that tells inbox providers what to do if SPF or DKIM checks fail.
DMARC (RFC 7489) is a TXT record at _dmarc.yourdomain.com that does two jobs. It tells receivers what to do with mail that claims to come from your domain but fails authentication (the p= policy: none, quarantine or reject), and it asks them to send you aggregate reports (rua=) listing every source that sends as your domain. A message passes DMARC when SPF or DKIM passes and the domain that passed aligns with the visible From domain.
How to set up DMARC
Start in monitoring mode with a record such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Google requires a DMARC record (p=none is allowed) from anyone sending more than 5,000 messages a day to Gmail, and Yahoo requires bulk senders to publish a DMARC policy and pass it.
Read the aggregate reports for a few weeks, fix any legitimate service that fails alignment, then move to p=quarantine and later p=reject if you want spoofed mail blocked. Reports arrive as XML files, so most teams route them to a DMARC reporting service that turns them into readable summaries.
The DMARC tags you will see
Beyond p= and rua=, the most common tags are sp= (a separate policy for subdomains), adkim= and aspf= (alignment mode: r for relaxed, the default, which accepts subdomains of your From domain, or s for strict, which requires an exact match) and pct= (the share of failing mail the policy applies to, useful when moving gradually to quarantine or reject). Publish only one DMARC record per domain.
Common DMARC mistakes
Jumping straight to p=reject. If your newsletter platform, CRM or billing tool is not aligned yet, receivers start rejecting your own mail.
Publishing p=none and never reading the reports. A monitoring policy is a starting point; it does not stop anyone spoofing your domain.
Assuming SPF and DKIM passes mean DMARC passes. If they pass only for your platform's domain rather than yours, alignment fails. A custom sending domain in your email platform usually fixes it.