What is DMARC?

A message can pass authentication for one domain while showing another domain to its recipient.

How does DMARC check a message?

The receiving server checks whether a passing SPF or DKIM result aligns with the domain in the visible From address. Either aligned pass is enough for DMARC to pass.

1. You publish your DMARC policy in DNS.
2. The receiver looks up the policy and checks SPF, DKIM and domain alignment.
3. If neither method passes and aligns, the receiver considers your requested failure policy alongside its own filtering rules.
4. Participating receivers send authentication reports to the addresses you specify.

SPF, DKIM and DMARC do different jobs. SPF checks whether a sending IP is authorized for the envelope-from domain, which receives bounces. DKIM verifies a signature over the signed message content. DMARC connects either result to the domain the recipient sees.

What does domain alignment mean?

Alignment means the authenticated domain matches the visible From domain under your chosen matching rule. For SPF, the authenticated identity is normally the envelope-from domain. For DKIM, it is the signature's d= domain.

Relaxed alignment allows subdomains that share the same organizational domain, the registered domain such as example.com. Strict alignment requires an exact match. For example, send.example.com aligns with example.com under relaxed SPF alignment, but not strict alignment.

The aspf and adkim tags select strict (s) or relaxed (r) alignment for each method. Both default to relaxed. How DMARC works covers the checks in more detail.

What goes in a DMARC record?

A DMARC record is a DNS TXT record at _dmarc beneath your domain. This example requests reports without requesting quarantine or rejection:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-afrf@example.com; pct=100"

Replace the example domain and reporting addresses with ones you control. The DMARC record explanation covers additional settings.

What can a DMARC policy enforce?

Your policy requests how receivers handle messages that fail DMARC. The receiver makes the final delivery decision.

DMARC addresses unauthorized use of your domain in the From address. It does not stop someone using a different, similar-looking domain or copying your display name. A DMARC pass also does not guarantee inbox placement. RFC 7489, the DMARC specification, leaves message acceptance with the receiver.

How do you start enforcing a policy?

Start with p=none and aggregate reporting, then identify and authenticate each legitimate sending source before tightening the policy. This prevents an enforcing policy from blocking a sender you forgot to configure.

Aggregate reports show the authentication results reported by participating receivers. Failure reports provide message-level details when a receiver supplies them. Missing reports do not establish that no one used your domain.

Move to quarantine or reject after resolving legitimate authentication failures. The DMARC policy explanation and setup steps cover that rollout.

How do you configure DMARC for Bird?

You publish the records returned for your sending domain: DKIM, the return-path CNAME and a valid DMARC policy. A valid policy covering the domain can be inherited from its organizational domain. p=none satisfies Bird's DMARC check.

The domain response reports the policy check in capabilities.dmarc.status. Check capabilities.sending.status for readiness across DKIM, return-path and DMARC. Both fields use these statuses:

The sending-domain guide covers verification, and the authentication guide explains the DNS records.