DMARC builds on top of two older standards. Here's how each one checks a different part of an email:
Sender Policy Framework. A DNS record listing which mail servers are allowed to send for your domain.
DomainKeys Identified Mail. A cryptographic signature added to outgoing mail that proves it wasn't altered in transit.
Ties SPF and DKIM to the visible From address, and tells receivers what to do when a message fails both.
Passing SPF or DKIM isn't enough on its own — the domain that passed has to align with the domain in your From address. A message can pass SPF for a third-party sender and still fail DMARC if that sender's domain doesn't match yours.
| Policy | What happens to failing mail |
|---|---|
p=none | Nothing — mail is delivered normally. Used to monitor before enforcing. |
p=quarantine | Sent to spam/junk folder. |
p=reject | Rejected outright by the receiving server. |
Most teams start at none, watch reports for a few weeks to confirm every legitimate sender is aligned, then move to quarantine and finally reject.
DMARC reports are the only way to see this safely. Every receiver that checks your DMARC record can send back a daily summary of what it saw — who sent mail as your domain, and whether it passed. That's the data DMARC Stack turns into a dashboard.