Field guide
DMARCbis in five minutes
DMARC just got its biggest update since 2015, now published as RFC 9989. Here is what it does, what changed, and the one line to check on your own domain. No jargon, no setup wizard, just the picture.
The idea
DMARC is the bouncer at your domain's door
Every email claims to be from someone. DMARC is the check at the door. It looks at a message that says it is from your domain, asks "can you prove it", and tells the receiving mailbox what to do when the answer is no.
Two IDs get checked. SPF says the sending server is on your guest list. DKIM is a tamper seal that proves the message was not changed on the way. DMARC is the bouncer who reads both, then follows the one instruction you left at the door.
One catch, and it is the one people miss. A pass only counts if it lines up. DMARC trusts SPF or DKIM only when the domain they check matches the domain your reader sees in the From line. That match is called alignment, and it is why mail can pass SPF and still fail DMARC.
That instruction is your policy. It has three settings.
Same record, one word different. This is what each one tells the bouncer to do with mail that fails the check.
The bouncer watches and takes notes, but lets everyone in. You get reports, spoofers still reach the inbox. This is where you start, not where you stop.
Fails the check, goes to the spam folder. Real protection, with a safety net in case something legitimate is not set up yet.
Fails the check, never delivered. This is the goal. A spoofed email wearing your domain gets stopped at the door.
Where the bouncer's instructions live
The policy is not in your email. It is one TXT record in your DNS, the same place your domain already lives, usually your registrar or DNS host like Cloudflare, GoDaddy or Namecheap. Add a record on a host named _dmarc, and every mailbox in the world can read it before it accepts a message from your domain.
Start with this exact record. p=none watches without touching a single message, so nothing breaks on day one. Some DNS panels want just _dmarc in the host field and add your domain for you, same record either way. The safe order to tighten it past none is further down.
Keep reading, free
The rest of the guide is one email away
What DMARCbis changes, the subdomain fix, the safe order to switch it on, and the one thing authentication still cannot buy you. Enter your email and the rest opens right here.
Confirm to save your copy and get The Signal, twice a month. Leave any time.