Understanding DMARC and Using the SendRepute Wizard
Learn what DMARC means, how alignment works, and how to use the SendRepute wizard to generate a DMARC record for your domain.
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol that helps domain owners manage their domain reputation. As defined in DMARC RFC 7489, it provides clear instructions to receiving mail servers on how to handle messages that fail authentication. DMARC builds upon two existing mechanisms: Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). By tying these protocols together, DMARC helps domain owners manage their brand identity and gives receivers a standardized way to evaluate incoming mail.
How DMARC Evaluation Works
For a message to achieve a DMARC pass, it must pass either an aligned SPF check or an aligned DKIM check. Alignment means the domain found in the visible "From" header matches the domain validated by SPF or the domain found in the DKIM signature. This requirement prevents malicious senders from passing authentication using their own domains while spoofing your brand in the visible header.
Alignment can be configured in two distinct ways:
- Relaxed alignment: The domains can share the same organizational domain. For instance, a subdomain used for marketing can align with a parent domain used in the visible header.
- Strict alignment: The domains must be an exact match. If the "From" address uses a subdomain, the SPF or DKIM domain must use that exact same subdomain.
Properly configured checks help secure your domain and ensure smooth delivery, as noted in the Gmail sender guidelines.
DMARC Policies and Cautious Rollout
When you configure DMARC, you instruct receivers on how to treat messages that fail authentication. The protocol offers three policy levels:
- p=none: The receiver takes no action against failing messages. This is a monitoring mode used to gather reports without affecting delivery.
- p=quarantine: The receiver is asked to place failing messages in the spam or junk folder.
- p=reject: The receiver is asked to block failing messages entirely.
A cautious rollout is highly recommended. Domain owners should start with a policy of "none" to monitor traffic, fix authentication gaps, and then gradually move to "quarantine" and finally "reject" once they are confident that legitimate mail is properly authenticated.
DMARC Reporting
DMARC provides visibility through two types of reports:
- Aggregate reports (rua): These provide daily XML summaries of authentication results. They are essential for monitoring your domain, identifying unauthorized senders, and verifying that legitimate mail sources are passing checks.
- Forensic or failure reports (ruf): These provide detailed information about individual messages that failed authentication. Support for forensic reports varies widely among mailbox providers due to privacy concerns, so they are considered optional.
Using the SendRepute DMARC Wizard
The SendRepute wizard helps you generate a valid DMARC record based on your desired policy and reporting preferences. You input your domain and email addresses for reports, and the wizard outputs a formatted text string.
You must take this generated record and publish it as a TXT record with your DNS provider. The wizard itself does not publish records or query live DNS. No tool changes DNS settings. The content classifier analyzes content only, not live DNS or blacklists. Separate Domain Check reads live public DNS and five selected public threat-intelligence sources; it is not a comprehensive check of all DNSBLs or private-provider blocklists. The classifier and builder do not send email. SendRepute Campaigns sends via your own connected provider; SendRepute is not a hosted SMTP delivery service. Our content classifier focuses on pre-send email content analysis, evaluating sender names, subjects, body text, links, formatting, and HTML signals before you send a message. When the account or action permits, the product can show probabilistic spam classification, confidence estimates, and detected terms. The platform also supports safe HTML corrections, manual edits, and optional AI rewriting in the product. These features provide content analysis to help you resolve spam signals and prepare stronger emails. For more context on how authentication fits into your broader strategy, read about Deliverability and Reputation.
Example DMARC Record
Here is an illustrative DMARC record for a domain using a monitoring policy and aggregate reporting:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;
In this example, the record applies to example.com and instructs receivers to send aggregate reports to dmarc-reports@example.com. You can find further technical details in the IETF DMARC RFC record.