DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record that tells receiving mail servers what to do when an email fails SPF and/or DKIM checks — reject it, quarantine it, or let it through — and gives domain owners visibility into who's sending email as their domain, including spoofing attempts.
DMARC doesn't replace SPF or DKIM — it sits on top of them. A message passes DMARC if it passes SPF or DKIM, and the domain in the visible "From:" address matches (is "aligned" with) the domain used in that passing check. This alignment requirement is why a message can pass SPF and DKIM individually but still fail DMARC — it's the alignment step that most often trips people up.
The most common causes of a DMARC fail are: (1) SPF passes for the sending server, but the "From:" domain doesn't match the domain SPF actually authenticated (often happens when a third-party tool sends on your behalf without proper alignment); (2) DKIM passes, but the signing domain (the d= tag in the DKIM signature) doesn't match the visible From domain; (3) email is forwarded through a server that breaks the DKIM signature or rewrites the sender, invalidating both checks.
1. Identify the failing source using your DMARC aggregate reports (sent to the rua= address in your DMARC record) — they show every sending IP and whether it passed or failed. 2. For each failing source, either bring it into SPF/DKIM alignment (add it to your SPF record and configure it to sign with your domain's DKIM key) or stop sending from it under your domain if it's unauthorized. 3. Start with a monitoring-only policy, p=none, so you can see failures without impacting delivery, then move to p=quarantine and eventually p=reject once you've confirmed all legitimate senders are aligned.
Use our Bulk DMARC Checker to confirm a DMARC record exists and read its policy across many domains at once — a quick way to find domains with no DMARC protection at all, which is a common gap for organizations managing several brands or client domains.