Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter topics…

Email Foundations

Email as a Distributed System
Actors, Protocols, and Standards
Hosts and Hostnames
IP Addresses and Addressing
Email Fundamentals

Authentication

Authentication
- SPF
- DKIM
- DMARC
- ARC
- BIMI
- MTA-STS
- TLS-RPT

DNS

DNS

Reputation

Reputation

Warmup

Warmup

Deliverability

Deliverability

Inbox Placement

Inbox Placement

Infrastructure

Infrastructure

Home
Learn
Authentication
DMARC

Learning path

Authentication
DNS
Reputation
Warmup
Deliverability
Inbox Placement

DMARC

Domain-based Message Authentication, Reporting, and Conformance.

Reading time:: 5 min
Difficulty:: Intermediate
Estimated duration:: 5 min
Prerequisites:: DNS, Authentication, TXT records
Last updated:: 2026-07-15
Author:: empire

Definition

Domain-based Message Authentication, Reporting, and Conformance.

Prerequisites

DNSDomain Name System — the lookup fabric email authentication depends on.
AlignmentWhether SPF/DKIM authenticated domains match the Header From domain.
TXT recordsDNS record type used for SPF, DMARC, and many auth artifacts.

DNSDomain Name System — the lookup fabric email authentication depends on.
AlignmentWhether SPF/DKIM authenticated domains match the Header From domain.
TXT recordsDNS record type used for SPF, DMARC, and many auth artifacts.
ARCAuthenticated Received Chain — preserves auth results across intermediaries.

DMARC alignment failureSPF/DKIM pass but fail identifier alignment.
DMARC policy not appliedPublished policy is not observed as expected by receivers.
DMARC record missingNo DMARC TXT record exists at the organizational domain.
DMARC reports not arrivingAggregate or failure reports are not received.
External reporting not authorizedExternal rua/ruf destinations lack DNS authorization.
Invalid DMARC syntaxDMARC record cannot be parsed by receivers.
Legitimate mail blocked after enforcementEnforcement blocks wanted senders still failing authentication.
Subdomains not protectedSubdomain traffic is outside effective DMARC coverage.
Unknown senders in DMARC reportsReports show sources not yet inventoried or authorized.

MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
dmarcian inspectorsDMARC-focused inspectors and educational tooling from dmarcian.
EasyDMARC free toolsFree DMARC/SPF/DKIM lookup and analysis utilities from EasyDMARC.
PowerDMARC free analyzersFree authentication analyzers from PowerDMARC for SPF, DKIM, and DMARC.
LearnDMARCInteractive DMARC learning and inspection helper for operators new to enforcement.
URIports toolsDMARC and related reporting tools for operators collecting aggregate feedback.

Open step-by-step: Configure DMARCPublish DMARC at monitoring policy and validate reporting.
Open step-by-step: Migrate authentication recordsMove SPF, DKIM, and DMARC to a new platform without dual-record failures.

Empire Services

SPF, DKIM, and DMARC implementationHands-on implementation of core authentication records and signing.

PreviousDKIM NextBIMI

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.