DMARC FAQ: Frequently Asked Questions About Email Authentication

Get answers to the most common questions about DMARC, SPF, DKIM, and email authentication.

General Questions

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that helps prevent email spoofing. It allows domain owners to specify how receivers should handle emails that fail authentication.

Why do I need DMARC?

You need DMARC to:

• Protect your domain from being spoofed by attackers
• Improve email deliverability by proving your legitimacy
• Meet requirements from Google, Yahoo, and Microsoft
• Gain visibility into who's sending email as your domain

Is DMARC required?

Yes, for many senders:

• Google/Yahoo (2024): Required for bulk senders (5,000+ emails/day)
• Microsoft (2025): Required for bulk senders
• All senders: Strongly recommended

What happens without DMARC?

Without DMARC:

• Anyone can send email pretending to be your domain
• Your legitimate emails may land in spam
• You have no visibility into email authentication failures
• You don't meet major provider requirements

SPF Questions

What is SPF?

SPF (Sender Policy Framework) is an email authentication method that specifies which IP addresses are authorized to send email for your domain.

How does SPF work?

1. You publish an SPF record in your DNS
2. When you send email, the receiver looks up your SPF record
3. The receiver checks if the sending IP is authorized
4. Result: pass (authorized) or fail (not authorized)

What does an SPF record look like?

v=spf1 include:_spf.google.com include:sendgrid.net -all

Components:

• v=spf1 - Version identifier
• include: - Authorize another domain's IPs
• -all - Reject all others

What is the SPF 10 lookup limit?

SPF is limited to 10 DNS lookups. Each include:, a, mx, and redirect counts. Exceeding this limit causes authentication failures.

How do I fix "too many DNS lookups"?

Options:

• Remove unused includes
• Use subdomains (each has its own limit)
• Flatten SPF records (replace includes with IPs)
• Use an SPF flattening service

DKIM Questions

What is DKIM?

DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was sent by the claimed domain and hasn't been altered.

How does DKIM work?

1. Your mail server signs outgoing emails with a private key
2. The signature is added to the email header
3. Receivers look up your public key in DNS
4. They verify the signature matches
5. Result: pass (valid signature) or fail (invalid)

What is a DKIM selector?

A selector is an identifier that allows multiple DKIM keys per domain. It's part of the DNS lookup:

selector._domainkey.example.com

Common selectors: google, selector1, s1, default

What key size should I use?

2048-bit RSA is recommended. 1024-bit is the minimum acceptable, and 4096-bit may have DNS length issues.

Do I need DKIM for every email service?

Yes. Each service that sends email as your domain should have its own DKIM configuration.

DMARC Questions

What does a DMARC record look like?

v=DMARC1; p=reject; rua=mailto:dmarc@reports.mailsentinel.io

Components:

• v=DMARC1 - Version
• p= - Policy (none, quarantine, reject)
• rua= - Address for aggregate reports

What are the three DMARC policies?

How long should I stay at p=none?

Typically 2-4 weeks. This gives you time to:

• Identify all legitimate sending sources
• Fix authentication issues
• Understand your email ecosystem

Can I apply the policy to only some emails?

Yes, use the pct= tag:

v=DMARC1; p=quarantine; pct=10

This applies quarantine to only 10% of failing emails.

What is DMARC alignment?

Alignment means the domain in the From: header matches the domain authenticated by SPF or DKIM. Without alignment, DMARC fails even if SPF and DKIM pass.

What's the difference between relaxed and strict alignment?

Relaxed (default): Organizational domains match

• SPF: mail.example.com ↔ example.com ✅

Strict: Exact domain match required

• SPF: mail.example.com ↔ example.com ❌

Reports Questions

What are DMARC aggregate reports?

Daily XML reports from email receivers containing:

• How many emails passed/failed
• Which sources sent email
• Authentication results

How do I read DMARC reports?

DMARC reports are XML and difficult to read manually. Use a tool like MailSentinel to:

• Parse reports automatically
• Visualize data
• Get actionable insights

What are forensic reports?

Detailed reports about individual failing emails. Less commonly sent due to privacy concerns.

Why am I not receiving DMARC reports?

Common reasons:

• DMARC record too new (wait 24-48 hours)
• rua= address not valid
• Receiving address has DMARC issues itself
• Low email volume

Implementation Questions

How do I set up DMARC?

1. Audit your email sources
2. Configure SPF for all sources
3. Configure DKIM for all sources
4. Publish DMARC record (start with p=none)
5. Monitor reports
6. Fix issues
7. Move to enforcement

See our Complete Setup Guide.

How long does DMARC take to implement?

• Basic setup: 1-2 hours
• Full deployment: 2-4 weeks
• Enforcement: 1-3 months

Timeline depends on email complexity.

Can DMARC break my email?

If implemented incorrectly, yes. That's why you:

• Start with p=none (monitoring only)
• Monitor reports before enforcing
• Use a gradual approach

Do I need DMARC for subdomains?

Yes. Either:

• Set sp= policy in your main DMARC record
• Publish separate DMARC records for subdomains

Can I have multiple DMARC records?

No. Only one DMARC record per domain. Multiple records cause failures.

Provider Questions

Does Google Workspace handle DMARC automatically?

No. Google Workspace provides:

• ✅ DKIM signing (you must enable)
• ✅ SPF (you must include _spf.google.com)
• ❌ DMARC (you must configure separately)

Does Microsoft 365 handle DMARC automatically?

No. Microsoft 365 provides:

• ✅ DKIM (you must enable)
• ✅ SPF (you must include spf.protection.outlook.com)
• ❌ DMARC (you must configure separately)

What about other email services?

Every email service needs to be included in your SPF and configured for DKIM. DMARC is always your responsibility.

Troubleshooting Questions

Why are my emails going to spam?

Common causes:

• SPF not configured correctly
• DKIM not signing
• DMARC failing
• Poor sender reputation
• Content issues

Check authentication headers first.

Why is DMARC failing?

Check:

1. Is SPF passing?
2. Is DKIM passing?
3. Is there alignment?

DMARC requires at least one (SPF or DKIM) to pass and align.

How do I check if DMARC is working?

1. Send test email to Gmail
2. Open email, click three dots → "Show original"
3. Look for "DMARC: PASS"

Or use MailSentinel for continuous monitoring.

Why do some sources fail while others pass?

Each source needs its own authentication:

• Source not in SPF → SPF fail
• Source not DKIM signing → DKIM fail
• Source domain doesn't align → DMARC fail

Review DMARC reports to identify failing sources.

Cost Questions

How much does DMARC cost?

DMARC itself: Free (it's a DNS record)

Monitoring tools:

• MailSentinel: $14-49/month
• Competitors: $8-8,000+/month
• DIY: Free but time-intensive

Is the investment worth it?

Yes. ROI includes:

• Improved deliverability (more revenue)
• Prevented fraud (protected reputation)
• Reduced support costs
• Compliance (avoid penalties)

Typical ROI: 1,000-50,000%+

See our ROI Calculator.

Security Questions

Can DMARC prevent all phishing?

DMARC prevents domain spoofing (emails that claim to be from your domain). It doesn't prevent:

• Look-alike domains (examp1e.com)
• Display name spoofing ("Your Company" <random@attacker.com>)
• Compromised accounts

Should I use p=reject?

Eventually, yes. p=reject provides maximum protection:

• Blocks all spoofed emails
• Prevents your domain from being used in attacks
• Demonstrates security commitment

But deploy gradually after monitoring.

Is DMARC enough for email security?

DMARC is essential but not complete. Also consider:

• Employee security training
• Email filtering/gateway
• MTA-STS for encryption
• BIMI for brand verification

Getting Help

Where can I learn more?

• DMARC Setup Guide - Complete configuration
• SPF Setup Guide - SPF configuration
• DKIM Setup Guide - DKIM configuration
• Email Authentication Glossary - Terminology

How do I get started?

1. Start Free Trial - MailSentinel, 14 days
2. Add your domain
3. Follow the setup wizard
4. Monitor your reports

Start Your Free Trial →