What Is DMARC? A Newsletter Publisher's Guide

DMARC is the record that tells Gmail, Yahoo and Outlook what to do with mail that claims to come from your domain but fails its checks. For years it was optional for most newsletters. It isn’t anymore.

Since February 2024, Gmail and Yahoo have required anyone sending more than 5,000 messages a day to their users to publish a DMARC policy, alongside SPF and DKIM. Outlook.com followed: since May 5, 2025, it rejects bulk mail that fails them.

If someone told you to “fix DMARC” and you’re not sure what you have, start here.

What DMARC does

Every email carries a From address, the one your readers see. DMARC lets the owner of that domain tell receiving mail servers two things:

1. What to do with mail that fails. Deliver it anyway, send it to spam, or refuse it.
2. Where to send reports. Summaries of who is sending mail as your domain, and whether it passed.

A message passes DMARC when it passes SPF or DKIM and that check lines up with the domain in the From address. Lining up is called alignment. A DKIM signature from your email platform’s own domain doesn’t count for yours, which is why platforms ask you to set up DKIM on your own domain.

What a DMARC record looks like

DMARC is a TXT record published at _dmarc.yourdomain.com. A starter record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

• v=DMARC1 says it’s a DMARC record. It has to come first.
• p= is the policy: none, quarantine or reject.
• rua= is where aggregate reports go. It’s optional, but it’s how you find out what’s sending as you.

Other tags you may run into: sp= sets a separate policy for subdomains, pct= applies the policy to only part of the failing mail, and adkim= and aspf= set how strictly alignment is checked.

p=none, quarantine and reject

• p=none asks receivers to take no action and just report. It meets the Gmail and Yahoo requirement, and it’s where everyone starts.
• p=quarantine asks them to treat failing mail as suspicious, which usually means the spam folder.
• p=reject asks them to refuse it. This is the strongest protection against someone else sending mail as your domain.

The path is the same for everyone. Publish p=none, read your reports for a few weeks, fix every service that sends as you without passing SPF or DKIM, then move to quarantine and finally reject.

Common mistakes

• Two DMARC records. A domain gets one. With two, receivers ignore both, so it’s as if you had none.
• The record in the wrong place. It belongs at _dmarc.yourdomain.com, not at the root of the domain.
• Forgetting a sender. Your newsletter platform, Google Workspace or Microsoft 365, your CRM, your billing tool: anything that sends as your domain needs to pass SPF or DKIM, aligned, before you tighten past p=none.
• Subdomain confusion. If you send from news.example.com and only example.com publishes DMARC, the parent’s policy covers you. That’s fine, as long as the main domain publishes exactly one record.

Reading DMARC reports

Once rua= is set, receivers send you aggregate reports as XML files, usually once a day. They’re unpleasant to read raw, but they answer one question well: which servers sent mail as my domain, and did they pass? A DMARC report reader, free or paid, turns them into a list. Look for services you recognize that are failing, and for senders you don’t recognize at all.

Frequently asked questions

Do I need DMARC for a small newsletter? The Gmail and Yahoo requirement applies above 5,000 messages a day to their users. But a p=none record takes minutes to publish and starts the reports that tell you who’s sending as you, so there’s no reason to wait.

Does DMARC improve deliverability? It doesn’t guarantee the inbox. It’s a requirement for bulk senders, so missing it can hurt, and having it lets receivers trust that mail from your domain really came from you.

How long does a new DMARC record take to work? As soon as the DNS change spreads, which usually takes minutes to a few hours depending on your DNS host.

Can I check my DMARC record for free? Yes. The DMARC checker looks it up, along with SPF and DKIM, with no signup.