A DMARC check looks at a message that has already gone through SPF and DKIM, and asks one more question: does the domain that passed either of those checks match the domain a recipient sees in the From address? If it does, DMARC passes. If it does not, the receiving server applies the policy the domain owner published in DNS, which tells it whether to deliver the message anyway, treat it as suspicious, or refuse it outright. DMARC verification is what turns two separate authentication results into one decision about spoofing.
A DMARC check pulls together results from earlier in the process rather than testing anything new on its own:
_dmarc.domain, which states the policy and where to send reports.d= domain, carried over from the DKIM check described in the companion post on how a DKIM check works.adkim= and aspf= tags, which decides how closely an authenticated domain must match the From domain.p= tag, which tells the receiver what to do when nothing aligns.The sequence above brings SPF and DKIM together into a single alignment check.
d= domain aligns with the visible From domain.Steps 3 and 4 check SPF's alignment; steps 5 and 6 check DKIM's alignment independently of SPF. A message only needs one of those two paths to succeed for DMARC to pass, which is why a forwarded message that fails SPF can still pass DMARC on a DKIM signature that survived the trip.
The p= tag is the part of a DMARC record that tells a receiver what to do with mail that fails alignment.
| Policy | What it means | What receivers do |
p=none |
Monitor only; no enforcement requested | Deliver the message normally and send reports if requested |
p=quarantine |
Treat failing mail as suspicious | Typically route the message to spam or flag it for review |
p=reject |
Refuse failing mail outright | Typically refuse the message during the SMTP transaction, before it reaches a mailbox |
These are requested handling instructions, not guarantees. A receiving system can apply its own local policy on top of what a domain publishes, so a p=reject record reduces the risk of a spoofed message reaching an inbox without making it impossible everywhere.
Alignment is the actual comparison between an authenticated domain and the visible From domain, and it comes in two modes. Relaxed alignment, the default, passes as long as the authenticated domain and the From domain share the same organizational domain: DKIM signed as mail.example.com aligns with a From address at example.com. Strict alignment requires an exact match, so mail.example.com would not align with example.com under strict rules.
Most domains run relaxed alignment, since third-party services such as marketing platforms or help desks often sign or send from a subdomain of the organizational domain. Strict alignment is a tightening step for domains that control every system sending in their name.
A DMARC record can include a rua= tag with one or more email addresses, and receiving providers use it to send aggregate reports, typically daily, summarizing every source that sent mail using the domain and whether each one passed aligned SPF or DKIM. Reading those reports is how a domain owner finds sending sources they did not know about before tightening the policy.
Legitimate mail fails DMARC more often from misconfiguration than from anything malicious:
d= instead of the customer's, so DKIM passes for the platform but never aligns for the customer.The companion article on how SPF, DKIM and DMARC work together covers how to inventory senders and roll a policy forward without breaking legitimate mail.
Truvo verifies SPF, DKIM and DMARC configuration as part of an effective security program, then hands over the evidence.
No. DMARC passes when either SPF or DKIM passes and aligns with the visible From domain. Both are not required, which is why DKIM alone can carry a forwarded message through even after SPF fails.
Quarantine asks receivers to treat failing mail as suspicious, usually by routing it to spam. Reject asks them to refuse it outright, typically before it reaches a mailbox. Both are requests; a receiver can still apply its own local policy.
No. It is the strongest of the three policies and meaningfully reduces the risk, but receivers decide how to apply local policy on top of what a domain publishes.
Alignment is the check that compares the domain authenticated by SPF or DKIM against the domain visible in the From address. Relaxed alignment allows a shared organizational domain; strict alignment requires an exact match.
A DMARC check does not authenticate a message on its own; it takes the SPF and DKIM results that already exist and asks whether either one aligns with the domain a recipient sees. When one does, DMARC passes. When neither does, the published policy, none, quarantine, or reject, tells the receiver what to do next, though every receiver still applies some of its own judgment on top. Built on accurate SPF and DKIM coverage and reviewed through its own reports, DMARC becomes the piece that ties a domain's email authentication together.