---
title: "DMARC explained"
description: "DMARC builds on SPF and DKIM, adds alignment rules, and enables aggregate and forensic reporting."
translationKey: "email-dmarc-explained"
tags: [dmarc, reporting, policy]
publishedAt: "2026-05-01"
lastReviewedAt: "2026-05-01"
indexable: true
faq:
  - question: "What is the practical difference between DMARC none and reject?"
    answer: "None collects authentication reports without affecting delivery, while reject instructs receivers to refuse mail that fails DMARC once your policy is enforced."
  - question: "Must I publish both SPF and DKIM if I use DMARC?"
    answer: "DMARC can pass when either aligned SPF or aligned DKIM authenticates successfully, but teams often publish both for redundancy and clearer aggregate reporting."
---
> **Canonical:** https://formreceipt.com/docs/email-deliverability/dmarc-explained

## Policy layers

A DMARC DNS TXT record at `_dmarc.example.com` declares your policy (`none`, `quarantine`, `reject`) and where reports should be sent.

## Alignment

DMARC passes when either SPF or DKIM aligns with the header From domain and passes authentication—depending on strict or relaxed alignment settings.

## Reports

Aggregate (`rua`) reports help you find unauthorized senders; forensic (`ruf`) reports are optional and may be restricted by large receivers.