What is DMARC? | GTM Vector

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC is an email authentication, policy, and reporting protocol. It builds on the SPF and DKIM protocols by adding a crucial element: an instruction from the domain owner to the receiving mail server on what to do if an email fails authentication.

TL;DR

Enforcement: Tells Gmail/Outlook exactly what to do with “fake” emails (none, quarantine, or reject).
Visibility: Provides daily reports on who is sending email using your domain.
Alignment: Ensures that the technical “hidden” domains (SPF/DKIM) match the “visible” domain the user sees.
Trust: Required by Google and Yahoo for anyone sending at scale.
Outbound Foundation: Without DMARC, your deliverability is at the mercy of the recipient’s “best guess.”

What DMARC is (and why Google cares so much)

For a long time, email authentication was a suggestion, not a requirement. Spammers exploited this by spoofing legitimate brands to steal data. DMARC was created to give domain owners a way to stop this.

In 2024, Google and Yahoo made DMARC mandatory for bulk senders, and Microsoft followed for Outlook.com in 2025. They care because it ties the authenticated domain to the domain the recipient actually sees. If you don’t have it, you are treated as a higher-risk sender.

What DMARC actually does

DMARC performs two primary functions:

Verification (Alignment): It checks if the SPF and DKIM domains “align” with the domain in the “From” header.
Policy Enforcement: It provides a blueprint for the receiving server: “If authentication fails, do X.”

How DMARC works with SPF and DKIM

Think of it as a three-layered security system:

SPF: The guest list (authorized IP addresses).
DKIM: The ID card (digital signature).
DMARC: The security guard at the door. The guard checks the guest list and the ID card, then looks at your Policy to decide whether to let the person in, put them in a holding room (spam), or kick them out (bounce).

DMARC alignment explained (simple terms)

Alignment is the “bridge” between technical authentication and what the user sees.

SPF Alignment: The domain in the Return-Path (envelope) must match the From address.
DKIM Alignment: The d= domain in the DKIM signature must match the From address.

DMARC passes if either SPF or DKIM passes and is aligned with the From domain.

DMARC policies explained

You set your policy using the p= tag in your DNS record:

p=none (Monitoring): “If it fails, let it through anyway, but send me a report.” Use this for the first 2-4 weeks to audit your sending sources.
p=quarantine (Spam): “If it fails, put it in the spam folder.” This is a safer middle ground to prevent major damage while still allowing some “almost-correct” email through.
p=reject (Blocking): “If it fails, reject it.” This is the goal for most domains, because it stops others from spoofing you.

How DMARC affects cold email deliverability

DMARC is a baseline trust requirement, not a reputation score.

Passing DMARC: Shows mailbox providers that the mail is authenticated for the domain the recipient sees.
Failing DMARC: Mail is often filtered to spam, rejected under a strict policy, or shown with a warning banner, which kills reply rates.

Common DMARC mistakes that break outbound

Moving to p=reject too fast: If you haven’t authorized your CRM, helpdesk, or marketing tools, you will block your own legitimate emails.
Missing DKIM selectors: If your outbound tool doesn’t have DKIM set up, it relies on SPF. If that fails (due to a forwarder), the email fails DMARC.
Syntactic Errors: Small typos like p= none; (extra space) or forgetting the semicolon can invalidate the record.
Ignoring Reports: DMARC aggregate reports (RUA) are the most complete way to see which sources pass or fail across all your mail.

DMARC record examples

1. Basic Monitoring (Start here): v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

2. Quarantine Policy (Step two): v=DMARC1; p=quarantine; pct=100; rua=mailto:reports@yourdomain.com

3. Strict Enforcement (The goal): v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:reports@yourdomain.com (Note: aspf=s means “Strict” SPF alignment required).

How to check and monitor DMARC

DNS Lookups: Use dig txt _dmarc.yourdomain.com or a tool like MXToolbox.
Monitoring Tools: Services like Postmark, Valimail, or Cloudflare DMARC Management can aggregate the XML reports into human-readable dashboards.
Manual Check: Send an email to a Gmail account and check “Show Original” to see the DMARC: 'PASS' status.

SPF vs DKIM vs DMARC

Protocol	Role	Analogy
SPF	IP Authorization	The “Authorized Senders” list.
DKIM	Digital Signature	The tamper-proof wax seal.
DMARC	Policy & Alignment	The security guard enforcing the rules.

FAQ

Does DMARC replace SPF and DKIM? No. DMARC requires SPF and DKIM to function. It’s the layer that sits on top of them.

What is DMARC alignment? It’s the requirement that the domain used in SPF/DKIM matches the domain the recipient sees in the “From” header.

Why did my DMARC fail even though SPF passed? Usually due to an alignment issue. SPF might have passed for the provider’s domain (e.g., amazonses.com), but if your From address is yourdomain.com, they don’t align.

Is DMARC alone enough for deliverability? No. It’s a technical prerequisite. You still need good content, clean lists, and proper volume management.

What happens if I don’t have a DMARC record? Gmail and Yahoo will likely reject your mail if you are a bulk sender, and other providers will flag you as higher risk.

Final Takeaway

For outbound teams, DMARC is a mandatory “License to Drive.”

Deploy p=none today to start gathering data.
Audit your sources: Ensure every tool (your sequencer, CRM, Google Workspace or Microsoft 365) is passing AND aligned. For cold outbound, use separate sending domains, never your main domain or a subdomain of it.
Iterate: Move to p=quarantine, then p=reject once you see 100% pass rates in your reports.

DMARC