RFC 7489 / START HERE
DMARC alignment and policy, before the details
DMARC: Domain-based Message Authentication, Reporting, and Conformance
DMARC connects email authentication results to the domain in the visible From address. It also lets domain owners publish handling preferences and request reports.
The idea in one picture
Mail claims a visible From domain
Authentication and alignment are checked
Domain policy and reporting apply
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
A message can pass an authentication check for an unrelated domain. DMARC checks alignment with the domain the reader sees. This is the original combined specification.
A familiar example
A company asks receivers to treat messages claiming its domain according to policy when aligned SPF or DKIM authentication fails.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Visible author and alignmentDMARC ties successful SPF or DKIM authentication to the RFC5322.From domain.→
- Discover domain policyThe receiver finds a DMARC TXT record for the author domain, with an Organizational Domain fallback.→
- Pass and policy dispositionPolicies none, quarantine, and reject describe requested handling for messages that fail DMARC.→
- Aggregate and failure reportsReports help domain operators see authentication and disposition results.→
- Mailing lists and limitationsForwarding and message transformations can disrupt the authentication paths DMARC depends on.→
This introduction explains RFC 7489 (2015). This publication has a successor; see the related guides and the RFC status. Read the original RFC ↗