What is DMARC? Email spoofing protection explained simply

DMARC (Domain-based Message Authentication, Reporting, and Conformance) lets the owner of a From domain publish how receivers should handle mail that fails authentication, and ask for reports on the results.

How it works

The DMARC record is a TXT record at _dmarc.yourdomain. A message passes when SPF or DKIM passes for a domain that aligns with the From domain.

Alignment can be relaxed (the domains share an organizational domain) or strict (they match exactly).

p=none: no specific action requested (monitoring only)
p=quarantine: treat failing mail as suspicious, such as sending it to spam
p=reject: refuse failing mail
rua=: where to send aggregate reports

Why it matters for newsletters

Google requires DMARC from senders of more than 5,000 messages a day to Gmail accounts. A policy of p=none is enough. The From domain must also align with the SPF or DKIM domain.

Yahoo requires bulk senders to publish at least p=none and to pass DMARC. It strongly recommends an rua tag for reports.

How to roll it out

Start with p=none and an rua address. Use the reports to confirm all your real sending sources pass.
Then consider moving to quarantine and later reject.
The DMARC specification, RFC 7489, is published as an Informational RFC, not a standards-track document.

How Newsletter Ready handles this

Newsletter Ready sends from its own domain with DKIM signing, and the domain has SPF and DMARC records in place.

Each issue is drafted by AI from your website articles. Nothing is sent until you approve it.

See a sample issue made from your website Email domain checker (SPF, DKIM, DMARC) →Gmail and Yahoo sender requirements →What is SPF? →What is DKIM? →

Email newsletter glossary

Sources

This page is general information, not legal advice.