How DMARC works with SPF and DKIM
| Protocol | What it does | DMARC requirement |
|---|---|---|
| SPF | Verifies the sending IP is authorized for the domain | SPF-authenticated domain must align with the From domain |
| DKIM | Verifies the email has not been tampered with | DKIM-signed domain must align with the From domain |
| DMARC | Sets policy for emails that fail both SPF and DKIM alignment | Published as a TXT record on _dmarc.yourdomain.com |
DMARC requires either SPF or DKIM to pass and align with the From domain. You do not need both to pass, but both configured provides strongest protection.
Creating a DMARC record
A DMARC record is a TXT DNS record added to_dmarc.yourdomain.com.
Monitoring mode
Quarantine mode
Reject mode
Policy options
p=none
Monitor only. No action taken on failing emails. Start here to collect data.
p=quarantine
Send to spam. Failing emails go to the spam folder. Good intermediate step.
p=reject
Block entirely. Failing emails are rejected. Maximum protection.
Gradual enforcement path
Start with p=none
Publish a DMARC record with
p=none and an rua address. Monitor aggregate reports for 2-4 weeks to identify all legitimate sending sources.Fix authentication gaps
Review aggregate reports. Any legitimate service sending on your behalf must pass SPF or DKIM. Update DNS records as needed.
Monitoring with aggregate reports
Aggregate reports (rua) are XML files showing which IPs sent email using your domain and whether they passed SPF, DKIM, and DMARC. Use a free DMARC report analyzer (DMARC Analyzer, Postmark DMARC, dmarcian) to visualize the data.
Common mistakes
Jumping straight to p=reject
Jumping straight to p=reject
Skipping the monitoring phase blocks legitimate emails from services you forgot to authorize. Always start with
p=none.Not including all sending sources in SPF
Not including all sending sources in SPF
If you send from HoopAI, Google Workspace, and Mailgun, your SPF record must include all three.
Multiple DMARC records
Multiple DMARC records
Only one DMARC TXT record per domain. Multiple records cause unpredictable behavior.
Forgetting subdomain policies
Forgetting subdomain policies
The root domain policy applies to subdomains by default. Use the
sp tag for different subdomain policies.Not monitoring after enforcement
Not monitoring after enforcement
Continue monitoring even after reaching
p=reject. New sending sources will fail DMARC if not added to SPF/DKIM.Connecting DMARC to HoopAI
- Ensure SPF and DKIM records are configured for your sending domain (see Email & SMTP setup)
- Add a DMARC record to your root domain’s DNS
- Monitor reports to confirm HoopAI-sent emails pass DMARC alignment
- Gradually enforce your policy