DMARC
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email standard that tells receiving mail servers what to do with messages that fail SPF or DKIM checks — and sends you reports. It prevents spoofing of your domain and is now effectively required by Gmail and Yahoo for bulk senders.
How it works
You publish a DMARC policy as a DNS TXT record. It sets a policy (none / quarantine / reject) for unauthenticated mail claiming to be from your domain, and an address to receive aggregate reports.
Why it matters
Without DMARC, anyone can spoof your domain, and major providers may throttle or reject your legitimate bulk mail. A 'reject' or 'quarantine' policy protects your brand and your deliverability.
What does a DMARC record look like, tag by tag?
The record is a TXT entry published at _dmarc.yourdomain.com. A starting example reads v=DMARC1; p=none; rua=mailto:[email protected]. The v tag must come first. The p tag sets the policy for the domain, sp sets a separate policy for subdomains, rua names where aggregate reports go and ruf where failure reports go, though many receivers never send the latter.
Two tags control alignment. adkim and aspf accept r for relaxed or s for strict. Relaxed, the default, lets mail signed by news.yourdomain.com align with a From address at yourdomain.com. Strict demands an exact match. The pct tag applies the policy to a percentage of failing mail, which is useful when stepping from none to quarantine. Our DMARC record generator assembles these tags without typos.
How do you read a DMARC aggregate report?
Receivers send an XML file, typically once a day, grouping your mail by source IP with a message count, the disposition applied, and the SPF and DKIM results. Take a hypothetical week of 10,000 messages. 9,400 come from your mailbox provider's IPs and pass. 500 come from an invoicing tool that signs with its own domain, so they fail alignment. 100 come from IPs you do not recognise, which is someone spoofing you.
The 500 are the ones to fix before tightening policy: add the tool to SPF or have it sign with a key under your domain. The 100 are exactly what quarantine and reject exist to stop. Raw XML is tedious, so most teams feed it into a report parser that groups rows by sender.
What breaks if you move to p=reject too early?
Every legitimate sender you forgot about. Helpdesk platforms, billing systems, HR tools and marketing forms often send as your domain, and under reject their unaligned mail is refused outright. Mailing lists and forwarders cause a second class of failure, because they rewrite content or relay from new IPs, breaking DKIM and SPF on the way.
A staged path limits the damage: p=none while reports accumulate, then p=quarantine with pct=25, then full quarantine, then reject. If cold outreach runs on a subdomain, sp lets you enforce there on a different schedule. Our DMARC setup guide for cold email walks through the order.
Does DMARC alone get cold email into the inbox?
No. DMARC proves the mail is authorised to use your domain; it says nothing about whether recipients want it. Gmail and Yahoo's 2024 bulk-sender rules require a DMARC record, and Google accepts p=none, but placement still depends on complaints, bounces and engagement. A domain at p=reject with a scraped list will still land in spam, because the policy only tells receivers what to do with mail that fails authentication, and the scraped mail passes. Autocloz monitors DMARC alongside DKIM signing and SPF on each connected domain and flags gaps before a campaign runs.
How Autocloz handles it
Autocloz monitors SPF, DKIM and DMARC for every connected sending domain and flags misconfigurations before they tank a campaign.
Free tools for this
No signup required — they run in your browser.
FAQ
Is DMARC required?
Since 2024, Gmail and Yahoo require SPF, DKIM and a DMARC policy for bulk senders. Even below bulk thresholds, DMARC materially improves deliverability and blocks spoofing.
What DMARC policy should I use?
Start at p=none to collect reports, confirm your legitimate mail passes SPF/DKIM aligned, then move to quarantine and finally reject.
Related terms
Cold email deliverability is the share of your outbound cold emails that actually reach the recipient's inbox (not spam, not blocked). It depends on domain authentication (SPF, DKIM, DMARC), sender reputation, mailbox warmup, list hygiene and content — not just whether the email was 'sent'.
SPF (Sender Policy Framework) is an email-authentication standard that lets a domain owner publish, in DNS, the list of mail servers allowed to send email on the domain's behalf. Receiving servers check the sending IP against that list to help detect spoofing and decide whether to trust the message.
DKIM (DomainKeys Identified Mail) is an email-authentication method that attaches a cryptographic signature to each message. The receiving server verifies the signature against a public key in the sender's DNS, proving the message wasn't altered in transit and genuinely came from the signing domain.
Mailbox warmup is the practice of gradually increasing a new email account's sending volume while generating positive engagement (opens, replies, moving mail out of spam) so mailbox providers build trust in the sender before real campaigns ramp up.
Sources
Want this applied to your setup?
This is a reference page. If you have a specific question about your own outreach, leave your email and a human on our team will reply.