RFC 9989 / START HERE
DMARC domain policy, before the details
DMARC domain policy
DMARC means Domain-based Message Authentication, Reporting, and Conformance. It checks whether email authentication aligns with the visible From domain and applies the domain's published policy.
The idea in one picture
Mail claims a From domain
Aligned authentication is evaluated
The receiver considers domain policy
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
This newer policy publication separates DMARC policy from its reporting specifications. The aim remains helping domains address unauthorized use of their names in email.
A familiar example
A receiving mail server looks up a domain's DMARC policy after checking the message's SPF and DKIM results.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Aligned authenticationA successful authentication must align with the Author Domain.→
- DNS tree walkThe current policy uses a bounded DNS tree walk rather than relying on one public-suffix-list interpretation.→
- Policy tags and scopeThe policy record expresses domain-owner preferences and alignment mode.→
- Receiver handlingDMARC evaluates domain authorization, while the mail receiver decides final handling.→
- Deployment and feedbackDomain owners can monitor streams, fix authentication, and then decide on stricter policy.→
This introduction explains RFC 9989 (2026). Read the original RFC ↗