How To: Read DMARC Results

In short. DMARC asks: did SPF or DKIM pass and align with the domain in the visible From? If not, the domain owner’s policy can reject or quarantine.

Alignment is the point

• SPF authenticates the envelope (Return-Path).
• DKIM authenticates the signing domain (d=).
• Neither, on its own, is the From chip you read.

DMARC requires identifier alignment: at least one passing check must match the From domain.

• SPF alignment — envelope domain matches From.
• DKIM alignment — the d= domain matches From.

Relaxed alignment (the default) allows a subdomain. Strict alignment (aspf=s / adkim=s) requires an exact match.

That is why spf=pass can still yield dmarc=fail: the envelope that passed is not the brand in From. A phish signed by evil.example can dkim=pass and still fail DMARC against From: bank.example.

Policy

Domains publish a record such as v=DMARC1; p=none. The p= tag is the request:

• none — monitor only; spoofs may still be delivered.
• quarantine — prefer junk or quarantine.
• reject — prefer to refuse the message.

Receivers are not obliged to obey, but dmarc=fail on a domain that should be enforcing it is a strong reason not to trust From.

In the simulator

• Hostile mail shows dmarc=fail with failing SPF and DKIM. The visible From is not authenticated.
• Real mail is noisier (forwarding, lists, third-party senders). When in doubt, read Authentication-Results first.