In short: DMARC is a DNS record that tells mail servers to quarantine or reject email that fakes your domain, and sends you reports. Start with p=none to monitor, then tighten to quarantine and reject.
Updated
Why it matters
Scammers can send email that looks like it comes from your domain. Customers and colleagues who receive it may trust it. DMARC lets you tell Gmail, Outlook and others to quarantine or reject those messages, and sends you reports so you can see who is sending as you.
Google and Yahoo also require a DMARC record from anyone who sends large volumes of email to their users.
How DMARC works
DMARC builds on two older checks. SPF says which servers may send for your domain. DKIM signs each message. DMARC says what to do when neither check lines up with the address people see in the From line.
The record is a single line of text in your domain settings (DNS), published at _dmarc.yourdomain.com.
Add DMARC in three steps
1. Make sure SPF and DKIM work for every service that sends your email: your mail provider, your newsletter tool, your invoicing system.
2. Publish a monitoring record: v=DMARC1; p=none; rua=mailto:you@yourdomain.com. This changes nothing about delivery and starts sending you reports.
3. After a few weeks, once the reports show only your own services, move to p=quarantine and later p=reject.
Common mistakes
Jumping straight to p=reject before every sender is set up, which blocks your own email. Forgetting subdomains. Leaving the monitoring address unread.
Free, no sign-up.
Check your email securityCommon questions
Is DMARC required?
Not by law in most places, but Google and Yahoo require it for bulk senders, and without it your domain is easy to fake.
What does p=none mean?
It means monitor only. Receivers still deliver failing messages, and you get reports.
Will DMARC stop all spam?
No. It stops other people faking your domain. It does not filter spam sent to you.