What Is DMARC?
DMARC is a DNS record that does two things: it requires SPF or DKIM to match the domain in the visible From address, and it tells receiving servers what to do when that check fails. It also asks them to report failures back to you.
Alignment is the part that makes DMARC matter. SPF and DKIM can both pass for a domain nobody sees, which is how convincing phishing used to slip through. DMARC closes that by insisting the authenticated domain matches the From address the recipient reads.
The policy has three settings. p=none monitors and changes nothing, which is where everyone should start. p=quarantine sends failures to junk. p=reject refuses them outright. Moving to reject before reading your reports is how organisations discover, loudly, that their invoicing system was sending mail nobody had authorised.
Google and Yahoo both began enforcing authentication requirements for bulk senders in 2024, which turned DMARC from good practice into a deliverability requirement.