DMARC Record Explained
Learn how DMARC combines alignment, published policy and message-level authentication.
Login2Cloud product team · Published 2026-09-27
What DMARC adds
DMARC connects an email’s visible From domain with a passing SPF or DKIM identity through alignment. A message does not need both mechanisms to pass DMARC if one passes and aligns under the applicable policy. A DNS record describes requested handling and reporting; the record alone does not establish a message-level pass.
Where the record lives
The policy is published at _dmarc followed by the relevant domain. The checker shows the observed policy and reporting tags. Organizational-domain discovery, subdomain policy and public suffix handling can matter when interpreting a real message. Treat a direct record lookup as a useful observation rather than a complete receiver simulation.
Read policy deliberately
A monitoring policy helps collect evidence before stronger enforcement. Quarantine and reject ask receivers to handle failing messages more restrictively. Receiver behavior and local exceptions can vary. Move toward enforcement after identifying legitimate senders and validating their alignment, rather than copying another organization’s policy.
Use reports responsibly
Aggregate reporting can reveal unexpected sending sources and authentication problems. Ensure reporting destinations are valid and authorized where required. Reports can contain operational information, so select processors and retention deliberately. A rua tag being present does not prove reports arrive or that they are being reviewed.
Check actual mail
Send through each production mail stream and examine authentication results at a receiving mailbox. Verify the visible From domain, SPF identity and DKIM signing domain. If the DNS policy looks correct but DMARC fails, alignment and provider configuration are more useful starting points than repeatedly republishing the same record.
Common questions
Does SPF PASS always mean DMARC PASS?
No. The passing SPF identity must align with the visible From domain, or an aligned DKIM signature must pass.
Does a DNS checker prove my messages authenticate?
No. Confirm that using message-level results from the receiving system.