Email security
How does DMARC work?
Short answer: When an email arrives, the receiving server checks SPF and DKIM, confirms they match the domain in the From address, and then follows your DMARC policy if they do not.
The full answer
The key idea is "alignment": it is not enough for SPF or DKIM to pass for some domain — the passing domain must match the one your reader sees in the From line.
If at least one aligned check passes, the email passes DMARC. If both fail, the receiver applies your policy: none (deliver), quarantine (spam folder) or reject (block).
Receivers then send summary reports to the address in your rua= tag.
Want step-by-step help? Read What Is DMARC? A Beginner’s Guide to DMARC Policies.