Definition

DMARC tells receiving mail servers what to do when SPF or DKIM fail, and sends you aggregate reports about authentication results for your domain.

Detailed Explanation

DNS record on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com; pct=100

Policy levels:

  • p=none — monitor only (start here)
  • p=quarantine — send failures to spam
  • p=reject — block failures entirely

Reports (rua) show which sources send as your domain — essential for catching spoofing and misconfigured ESPs.

Nepal Context

Implement DMARC before scaling email marketing beyond a few hundred subscribers. Start with p=none, review reports for 2–4 weeks, then tighten policy.

Practical Examples

  • A school starts with p=none and finds from reports that its old cPanel server is still sending newsletters; it moves those to its email platform before tightening the policy.
  • An online store moves to p=quarantine after a month of clean reports, so spoofed “order confirmation” emails land in spam instead of inboxes.

How to Check It

  1. Look up the record with an online DMARC checker or nslookup -type=txt _dmarc.yourdomain.com.
  2. Send a test email to a Gmail account, open Show original, and confirm DMARC: PASS.
  3. Read the aggregate (rua) reports through a free DMARC report viewer; the raw XML is hard to read directly.

Key Takeaways

  • DMARC requires SPF and/or DKIM alignment
  • Progress: none → quarantine → reject
  • Monitor aggregate reports weekly

Common Mistakes

  1. Jumping to p=reject without monitoring
  2. No report email configured (rua)
  3. SPF/DKIM not aligned with From domain