What is DMARC?

Two older checks sit underneath it. SPF lists which servers may send for your domain. DKIM adds a signature to each message. DMARC builds on both. It asks one more question: does the domain the reader sees in the "From" line match the domain that passed those checks? That match is called alignment¹.

You publish a DMARC policy in your domain's DNS records. Receiving servers read it when your mail arrives. The current specification, RFC 9989 from May 2026, replaces the original DMARC RFC 7489¹.

• none. You state no preference. The standard calls it monitoring mode: receivers can still check and, if you ask for them, send reports about who is sending as you¹.
• quarantine. You consider failing mail suspicious. Google describes the effect as failing messages going to the recipient's spam folder².
• reject. You consider failures a clear sign the mail is not genuine¹. Google says such messages are rejected by receiving servers and never delivered².

Google's Workspace guidance recommends a staged rollout: start with none, read the daily reports for at least a week, then apply quarantine to a small share of messages and raise it over time². Watch first, tighten later. Jumping straight to reject can block your own legitimate mail if a tool you forgot about sends on your behalf.

Your shop, your email platform, your helpdesk and your review tool may all send mail as your domain. DMARC is how you find out which ones are set up properly. It also makes it harder for someone else to send fake emails that look like yours.

It is one part of email deliverability: whether your messages reach the inbox or land in spam. Easy unsubscribing, covered under one-click unsubscribe, is another part. The money case for email is in customer retention strategy ecommerce.

For ZFD: We treat "p=none, never looked at" as a to-do, not as a finished setup.