# DMARC (Domain-based Message Authentication, Reporting & Conformance): Definition and How It Works

Source: https://wraps.dev/glossary/dmarc

DMARC is a DNS TXT record that tells receivers what to do with mail claiming your domain that fails SPF and DKIM alignment, and where to send reports about it — the enforcement layer on top of both.

## The one required tag decides everything downstream

The record lives at \`\_dmarc.<domain>\`, starts with \`v=DMARC1\`, and requires exactly one tag: \`p=\`, set to \`none\`, \`quarantine\`, or \`reject\`. \`none\` means monitor only — nothing is rejected because of this policy, which makes it the correct starting point while you confirm every legitimate sending source is authenticated, but it is not enforcement and should not be treated as "DMARC is set up." \`quarantine\` and \`reject\` are the two enforcing policies; only they change what a receiver actually does with a failing message.

## np= closes a gap p= and sp= do not cover

DMARCbis (RFC 9989) added \`np=\`, the policy for subdomains that do not exist at all — closing a spoofing gap where an attacker sends as a made-up subdomain of your domain that has no MX, no A record, nothing. \`sp=\` only covers subdomains that do exist; without \`np=\`, a non-existent subdomain effectively falls back to \`p=none\` regardless of how strict your main policy is. Wraps' checker warns when a domain is enforcing at the top level but has no \`np=\` set.

## t=y replaced pct= for ramping into enforcement

The older way to ramp into an enforcing policy gradually was \`pct=\`, applying the policy to only a percentage of failing mail. DMARCbis retires that: modern receivers apply the policy as all-or-nothing and ignore \`pct=\` below 100. The replacement is \`t=y\`, a testing flag that tells receivers to evaluate the policy for reporting purposes but not to act on it — the honest way to watch what an enforcing policy would do before it actually does it.

## Alignment mode, reporting, and what "enforcing" means here

\`aspf=\`/\`adkim=\` set alignment strictness (see the \`dmarc-alignment\` entry), \`rua=\`/\`ruf=\` name mailto: addresses for aggregate and forensic reports, and \`pct=100\` (or omitted) is the only value that still does what it says. Throughout Wraps' own content, "enforcing" means \`p=quarantine\` or \`p=reject\` specifically — \`p=none\` is DMARC published, not DMARC enforcing, and BIMI eligibility and several other downstream benefits depend on that distinction rather than on the record simply existing.

## Why it matters

A DMARC record with p=none is table stakes and is not a defense against spoofing — it is a listening post. Moving to an enforcing policy is the step that actually stops a forged message from reaching the recipient's inbox using your domain's name, and it is also the step that unlocks BIMI, since BIMI explicitly checks for an enforcing DMARC policy before it will show a brand logo.

## How to check it

```
dig +short TXT _dmarc.example.com
```

## Common questions

### Is p=none the same as having DMARC set up?

It publishes a record, but it enforces nothing — a message that fails alignment is still delivered exactly as if no DMARC record existed. Reports start flowing, but no spoofed mail is actually stopped until the policy moves to quarantine or reject.

### Should I still use pct= to ramp into DMARC gradually?

No. DMARCbis-conformant receivers ignore pct= below 100 and enforce all-or-nothing. Use t=y instead: it evaluates the policy for reporting without acting on it, which is the honest way to see the blast radius before it is real.

### What does np= protect that sp= does not?

sp= only applies to subdomains that actually exist. np=, added in DMARCbis, covers subdomains that do not exist at all, which is exactly the gap an attacker exploits by sending from a made-up subdomain with no other DNS records.

### Do I need DMARC if I already have SPF and DKIM?

Yes. SPF and DKIM each authenticate independently, but neither one ties its result back to the visible From address a recipient reads. DMARC is the layer that requires one of them to align with that From domain and states what happens when neither does.