Question 1

What is DMARC?

Accepted Answer

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds on SPF and DKIM. It lets domain owners specify what to do with emails that fail SPF/DKIM checks: monitor (p=none), quarantine to spam, or reject outright. DMARC drastically reduces email spoofing and phishing.

Question 2

What is SPF?

Accepted Answer

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. When a server receives an email, it checks the sending server's IP against the SPF record. An ~all (softfail) or -all (hardfail) suffix rejects unauthorized senders.

Question 3

What is DKIM?

Accepted Answer

DKIM (DomainKeys Identified Mail) cryptographically signs outbound email. The public key is published as a DNS TXT record under a selector (e.g. google._domainkey.domain.com). Receiving servers verify the signature matches, proving the email came from an authorized sender and was not tampered with in transit.

Question 4

What DMARC policy should I use?

Accepted Answer

Start with p=none to monitor without rejecting, then move to p=quarantine once you're confident legitimate email aligns correctly. Finally switch to p=reject for maximum protection. The rua= parameter sends aggregate reports to help you monitor alignment before tightening policy.

Question 5

Why does my DMARC score matter for deliverability?

Accepted Answer

Major providers (Google, Microsoft, Yahoo) use DMARC alignment to determine inbox vs spam placement. From February 2024, Google and Yahoo require DMARC for bulk senders. A strong p=reject policy with SPF and DKIM alignment significantly improves deliverability and protects your brand.

DMARC, SPF & DKIM Checker

Email Security FAQ