These answers cover DMARC (RFC 9989, which replaced RFC 7489 in May 2026) and the two checks it builds on, SPF (RFC 7208) and DKIM (RFC 6376). Each one was checked against the standard or the provider's own page on 19 October 2026. An older version of this page said DMARC stops phishing outright. It does not, and the answer below explains why.
Where to start
Why am I not getting forensic (ruf) reports?
Because almost nobody sends them. A ruf tag is a request, and the large mailbox providers have said no. Microsoft's April 2025 post on Outlook.com sender rules says: "We send RUA to the addresses specified in your DMARC record ... We don't have plans to send RUF." Google's DMARC setup page lists ruf as "Not supported" for Gmail.
The standard allows this. RFC 9989 says receivers "MAY choose to send" failure reports, and notes that receivers worried about privacy "have either chosen to heavily redact the information in such reports ... or not send them at all." RFC 9991, the failure reporting spec, explains the worry: a report can carry the headers or the whole failed message, and that may include personal data about the recipient.
What to check before you give up on them:
- The record has a
ruf=mailto: address. With no ruf tag, receivers must not send failure reports.
fo asks for the cases you care about. The default fo=0 only reports when SPF and DKIM both fail to align; fo=1 reports when either one fails.- A
ruf address on another domain is authorised by a _report._dmarc TXT record on that domain, the same check used for rua.
Even with all three right, expect few or none from Gmail and Outlook.com. Your aggregate (rua) reports already list every sending IP with its SPF and DKIM results, which is enough to find and fix senders. You can read them in the DMARC report analyzer without uploading the file anywhere.
Frequently asked questions
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance, now defined in RFC 9989, which replaced RFC 7489 in May 2026) is a TXT record published at _dmarc.yourdomain. It tells receivers what to do with mail that fails SPF and DKIM alignment with your From domain, and where to send reports about it.
Why does DMARC matter?
Without it, anyone can send mail that shows your exact domain in the From line, and receivers have no instruction from you on how to treat it. DMARC also gives you reports showing every server sending as your domain. Gmail now requires a DMARC record from anyone sending 5,000 or more messages a day to personal Gmail accounts.
Can DMARC stop phishing?
Only one kind. At p=quarantine or p=reject it blocks mail that spoofs your exact domain in the From address. It does nothing against lookalike domains, a fake display name on a free mailbox, or mail from a real account that was compromised.
How is DMARC different from SPF and DKIM?
SPF checks whether the sending server is allowed for the envelope sender domain, and DKIM checks a signature for the domain in its d= tag. Neither looks at the visible From address. DMARC passes a message when SPF or DKIM passes for a domain aligned with From, and applies your policy when neither does.
What does DMARC compliance mean?
It is not a term from the RFC. In practice it means a message passed DMARC, or that a domain publishes a valid record, often at p=quarantine or p=reject. Check which meaning a vendor or auditor is using before you answer them.
Does DMARC break forwarded email?
It can. Forwarding changes the sending IP, so SPF fails, and mailing lists that edit the subject or footer can break DKIM. ARC (RFC 8617, an Experimental standard) lets the forwarder record the original results so the final receiver can choose to trust them, and a valid DKIM signature is the best protection on your side.
What is DMARC alignment, relaxed or strict?
Alignment means the domain that passed SPF or DKIM matches the From domain. Relaxed (the default, aspf=r and adkim=r) accepts the same organisational domain, so mail.example.com aligns with example.com. Strict (s) needs an exact match.
What does p=none do?
p=none asks receivers to deliver failing mail as they would anyway and to send you reports. It gives no protection by itself. Use it to find your senders, then move to quarantine and reject.
What are rua and ruf?
rua is the address for aggregate reports: daily XML summaries of sending IPs, message counts and SPF, DKIM and DMARC results. ruf is the address for failure reports about single messages. Gmail does not support ruf and Microsoft says Outlook.com has no plans to send it, because these reports can contain message content.
How long does it take to reach p=reject?
There is no fixed timeline in any standard. The time goes into finding every service that sends as your domain and giving each one aligned SPF or DKIM. Move to quarantine, then reject, once your aggregate reports show only legitimate sources and they all pass.
Does DMARC affect deliverability?
Yes, mostly in your favour. Gmail says mail from a domain with no DMARC policy may be rate limited, rejected or sent to spam if you are a bulk sender. The risk is setting quarantine or reject before your own tools are aligned, which sends your real mail to spam or bounces it.
Do subdomains inherit the DMARC policy?
Yes. A subdomain with no record of its own uses the organisational domain's record, and the sp tag sets its policy; if sp is absent, p applies. RFC 9989 (May 2026) adds an np tag for subdomains that do not exist in DNS, which falls back to sp and then p when absent.
Can I have two DMARC records?
No. If a receiver finds more than one v=DMARC1 record at the same _dmarc name, RFC 9989 says all of them are discarded, as if you had published none. Merge everything into one record, listing several report addresses in rua separated by commas.
What DMARC policy does BIMI require?
The BIMI Group requires DMARC at enforcement on the organisational domain and its subdomains: p=quarantine or p=reject, with sp not set to none. A p=none policy or a pct value below 100 is not accepted.