Definition
DMARC ties SPF and DKIM to the domain the recipient sees, the one in the From field: a message passes DMARC when either check succeeds for an aligned domain. The record, published at _dmarc.example.com, sets a policy (p=none to observe, p=quarantine to send to spam, p=reject to refuse) and a reporting address (rua).
Since May 2026, DMARC has been an IETF standard (RFC 9989), replacing the 2015 RFC 7489: the pct tag is gone, the t=y tag marks a policy under test, and the np tag sets the policy for subdomains that do not exist.
Value for a business owner
Gmail requires DMARC from bulk senders, and Outlook.com above 5,000 emails a day, with at least p=none. Only the quarantine and reject policies stop a third party from sending in the company's name, and the reports show who sends on its behalf.
At Stratedge Consulting
We publish DMARC in monitoring mode, read the reports until every legitimate sender is aligned, then move to reject. Our free SPF, DKIM and DMARC test reads the published policy.
Common mistakes
Staying at p=none for years without reading the reports: the record exists, but nobody knows who sends in the company's name.
Keeping pct=0 to test a policy: RFC 9989 no longer recognises that tag, and t=y replaces it.