SPF and DKIM prove things, but neither says what a receiver should do when a proof fails, and neither checks the address the reader sees. DMARC does both.
What it adds
- Alignment. DMARC passes only if SPF or DKIM passes and the domain it checked matches the domain in the visible From address. See DMARC alignment.
- A policy. You tell receivers what to do with failing mail: nothing, quarantine it or reject it. See DMARC policy.
- Reports. Receivers send you data about who is sending mail as your domain, in aggregate reports.
What a record looks like
It is a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:[email protected]p=none collects reports without affecting delivery. rua says where reports go.
DMARC and Amazon SES
SES does not publish a DMARC record for you. You add it, and you decide the policy. For DMARC to pass you need DKIM signing on your own domain, which Easy DKIM provides, or a custom MAIL FROM domain so SPF lines up. One of the two is enough.
Why it matters now
Gmail and Yahoo require a DMARC record from bulk senders. Beyond that rule, an enforced policy stops others from sending convincing mail as you, and it is the gate for showing your logo with BIMI.
The usual path
Publish p=none with a report address. Read the reports to find every service that sends as you. Fix the ones that fail. Move to quarantine, then to reject.
Common questions
Do I need DMARC if I already have SPF and DKIM?
Yes. SPF and DKIM only say what passed. DMARC says what to do when they fail, and it checks that the passing domain matches your From address.
Can DMARC block my own email?
Yes, if you enforce it before every legitimate sender is aligned. That is why you start with a monitoring-only policy and tighten it later.