DMARC is a DNS record that tells receiving inboxes what to do with email that claims to come from your domain but fails SPF or DKIM checks, and where to send reports about it. Its policy can be none, quarantine or reject. Gmail and Yahoo require it for bulk senders.
Cold email and lead gentopic
2 minread
2related terms
In one line
A DNS record that tells inboxes what to do with mail that fails SPF or DKIM checks, and where to send reports. Gmail and Yahoo require it for bulk senders.
DMARC builds on SPF and DKIM. A message passes DMARC when it passes SPF or DKIM and the passing domain aligns with the domain in the visible From address. That alignment step is what stops someone else from easily sending mail that looks like it came from you.
The policy decides what happens to failures. With p=none, inboxes deliver as normal but send you reports. With quarantine, failing mail tends to go to spam. With reject, it is refused. Most teams start at none, read the reports, fix every legitimate sender, then tighten the policy.
Google requires senders of more than 5,000 messages a day to Gmail to publish DMARC, with a policy of at least none. Yahoo sets a similar rule and strongly recommends a reporting address.
Why it matters to recruiters
Without DMARC, spammers can spoof your agency or company domain, which damages trust with candidates and clients. Missing DMARC also hurts inbox placement for high volume outreach. A correct DMARC setup protects your brand and helps legitimate recruiting email reach the inbox.
An example from a recruiting desk
One week after an agency adds DMARC with p=none and a reporting address, reports show mail from its domain sent by an old marketing tool nobody remembered, plus spoofed messages from unknown servers. The team adds the marketing tool to SPF and DKIM, then moves to quarantine. Spoofed mail stops reaching candidates' inboxes.
Tips that help
Start with p=none and a reporting address so you can see every source sending as your domain.
Fix SPF and DKIM for each legitimate sender before tightening the policy.
Move to quarantine and then reject in stages while watching reports.
Publish DMARC on secondary outreach domains too.
Mistakes to avoid
Jumping straight to reject and blocking your own ATS or newsletter mail.
Setting up DMARC with no reporting address and never reading the results.
Frequently asked questions
What DMARC policy should I use?
Start with none to collect reports without affecting delivery. Once every legitimate service passes SPF or DKIM with alignment, move to quarantine and then reject for the strongest protection against spoofing.
Is DMARC required for sending email?
Google and Yahoo require DMARC for bulk senders, and Google defines that as more than 5,000 messages a day to Gmail. Smaller senders are not strictly required to publish it, but it is good practice for any domain.
What do DMARC reports show?
They show which servers sent mail using your domain, how many messages, and whether those messages passed SPF, DKIM and alignment. Raw reports are XML files, so most teams use a reporting tool to read them.
