Question 1

What is DMARC?

Accepted Answer

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM. It tells receiving servers what to do when SPF or DKIM checks fail: none (monitor), quarantine, or reject.

Question 2

What DMARC policy should I use?

Accepted Answer

Start with p=none to monitor without affecting delivery. Once you've confirmed all legitimate sources pass SPF/DKIM, move to p=quarantine, then p=reject for maximum protection against spoofing.

Question 3

What are DMARC aggregate reports (rua)?

Accepted Answer

The rua tag specifies where receiving servers should send XML aggregate reports about email authentication results. These reports help you understand who is sending email on behalf of your domain.

Question 4

What is DMARC alignment?

Accepted Answer

DMARC checks that the domain in the From header aligns with the domain authenticated by SPF (envelope sender) or DKIM (d= domain). Alignment can be 'strict' (exact match) or 'relaxed' (organizational domain match).

Question 5

Why is DMARC important for email deliverability?

Accepted Answer

DMARC is required by major mailbox providers (Google, Yahoo, Microsoft) for bulk senders. Without DMARC, your emails are more likely to land in spam. A proper DMARC policy also protects your domain from being used in phishing attacks.

Question 6

What is the sp tag (subdomain policy)?

Accepted Answer

The sp tag defines the DMARC policy for subdomains (e.g. mail.example.com). If absent, subdomains inherit the parent domain's p= policy. Set sp=reject to prevent subdomain spoofing even if your main policy is more relaxed.

Question 7

What is the difference between rua and ruf?

Accepted Answer

rua receives aggregate reports — daily XML summaries of authentication results per sending source. ruf receives forensic (failure) reports — individual message details when authentication fails. Most providers only support rua; ruf adoption is limited due to privacy concerns.

Question 8

What does the pct tag do?

Accepted Answer

The pct tag controls what percentage of failing messages the policy applies to. pct=100 (default) applies to all. During rollout, you can use pct=10 to apply quarantine/reject to only 10% of failures while monitoring the rest.

Question 9

Can I set up DMARC without SPF or DKIM?

Accepted Answer

Technically yes — DMARC only requires one of SPF or DKIM to pass with alignment. However, best practice is to deploy both. SPF alone breaks on forwarding; DKIM alone doesn't cover envelope sender. Together they provide robust authentication.

Question 10

How do I protect subdomains I don't use from spoofing?

Accepted Answer

Publish a DMARC record with p=reject on each unused subdomain, or use sp=reject on the parent domain. Also add empty SPF records (v=spf1 -all) and consider a wildcard _dmarc record for comprehensive coverage.