Deliverability
DMARC explained — without the acronym soup
What DMARC actually does, why the report files matter, and how to read a DMARC aggregate report in five minutes.
9 Feb 2026 6 min readBy Autocloz Editorial, Deliverability team
DMARC in one sentence
DMARC hands receiving mail servers one instruction: when a message *claims* to come from your domain but can't prove it (SPF and DKIM both failed), do one of three things — reject it, drop it in spam (quarantine), or wave it through and just tell you (report only).
The three policy levels
- p=none — report only. Good for the first 30 days while you fix what breaks. Sit at p=none past two months and it usually means nobody's reading the reports.
- p=quarantine — recipients drop failing mail into spam.
- p=reject — recipients bounce failing mail outright.
What a DMARC report file looks like
Every ISP that touches your mail sends you a daily ZIP wrapping one XML file (RFC 7489). Inside: each IP that sent mail claiming your domain, and whether SPF and DKIM aligned. It reads like machine exhaust.
Autocloz parses those files for you and names the misaligned senders in plain English.