DMARC

DMARC, Domain-based Message Authentication, Reporting and Conformance, is a TXT record published at _dmarc.yourdomain.com. It authenticates nothing by itself. It sits above SPF and DKIM and adds the three things they lack: alignment, policy, and reporting.

Alignment is the central idea. SPF authenticates the envelope domain and DKIM authenticates the domain in its d= tag, but the identity a person trusts is the From: header, which neither check examines. An attacker can register a domain, publish a valid v=spf1 record and signing key for it, and earn genuine passes while displaying your brand. Alignment tests whether the authenticated domain matches the From: domain. Under relaxed alignment, the default, a match at the organizational domain suffices, so mail.example.com aligns with example.com. Under strict, set with adkim=s or aspf=s, the domains must match exactly.

Policy is the p= tag. p=none is monitor only: failing mail is reported and delivered anyway. p=quarantine routes it to junk. p=reject refuses it, and is the only value that stops exact-domain spoofing. sp= sets a separate policy for subdomains, and pct= applies the policy to a sample so enforcement can be ramped.

Reporting is the rua= tag, which is independent of p=. Aggregate reports arrive as compressed XML whatever the policy, so they keep flowing after you enforce. Those reports are how every legitimate sender failing alignment is found before the policy tightens.