Email glossary · Practical guide
DMARC: connect authentication to the visible From domain
DMARC evaluates authenticated domain identity against the message's From domain and lets domain owners publish handling preferences. Having a DMARC record is not the same as passing DMARC.
Reviewed · Examples are illustrative
Who this helps: Readers checking a term before making an outreach or mailbox decision.
Meaning and common confusion
A practical review needs both configuration and message evidence. Record the visible author domain, the passing authentication identity and the receiver's DMARC result. RFC 9989, published in May 2026, replaces the earlier core specification; receiver deployment behavior still needs verification.
Worked example
This is a synthetic illustration, not a customer result or a live configuration to copy.
DNS: a DMARC policy exists
Message: neither passing identity aligns
Result: a record exists, but this message can fail validation
Separate task: verify a legitimate sending path before strengthening policy.Checks to make
- Review a controlled message from every legitimate sender.
- Keep reporting and policy enforcement as distinct decisions.
- Use current standards and actual receiver results when diagnosing edge cases.
Next step and limits
Start with the setup guide, then review alignment and reporting. Do not promise inbox placement from a passing result or apply an enforcement policy before understanding legitimate traffic. Provider requirements may add conditions beyond the core protocol.
Source references
Worked examples are illustrative. Editorial procedures are suggested methods, not measured performance claims or promises of additional product features.
Related guides
- Set up DMARC with a sender inventory and a working report destination →
- Move DMARC from monitoring to enforcement with explicit release gates →