Skip to main content

AWS Glossary

DMARC

Domain-based Message Authentication, Reporting and Conformance — email policy that tells receivers what to do when SPF/DKIM fail alignment.

Last reviewed: July 2026
DMARC.org overviewAmazon SES DMARC

Definition

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT policy on _dmarc.example.com that tells receiving mail systems what to do when a message claiming your domain fails SPF and/or DKIM alignment. Policies climb a ladder: p=none (monitor), p=quarantine, p=reject. Aggregate (rua) and forensic (ruf) reports help you find unauthorized senders before enforcement.

When to use it

  • Any domain that sends production email (transactional or marketing)
  • Meeting Google/Yahoo/Microsoft bulk-sender minimums (at least p=none with working SPF+DKIM)
  • As a prerequisite for BIMI (typically needs enforcement-level DMARC)

When not to use it

  • Jumping straight to p=reject before all legitimate senders (ESPs, CRMs, ticketing) are aligned — you will quarantine your own mail
  • Publishing DMARC without collecting and reading rua reports for several weeks

Tips

  • Start at p=none, inventory failures, then raise pct and policy carefully
  • Require alignment (organizational domain match) — SPF/DKIM “pass” alone is not enough for DMARC pass
  • Prefer a dedicated reporting mailbox or SaaS parser; raw XML volume grows fast

Gotchas

Serious

  • Multiple ESPs sending as @brand.com without DKIM/SPF alignment → enforcement blocks real campaigns
  • Treating p=none as “done” forever while spoofing continues

Regular

  • Forgetting subdomains (sp= policy) used by legacy apps

Related FactualMinds content

Related Services

Amazon SES Email Deliverability Consulting | FactualMinds

Amazon SES email consulting from an AWS Select Tier Partner. SPF/DKIM/DMARC setup, inbox placement optimization, sender reputation, and scalable email infrastructure.

View service

SES Migration & Email Delivery Services | FactualMinds

SES migration consulting — move from SendGrid, Mailgun, Postmark, or SparkPost to Amazon SES. Deliverability, SPF/DKIM/DMARC, monitoring, compliance.

View service

Related Articles

BIMI with Amazon SES: Complete Implementation Guide (VMC, SVG, DMARC)

BIMI on Amazon SES: lab readiness score 38→92 after DMARC quarantine at pct=100, SVG MIME fix, and CloudFront OAC — plus Terraform/CDK and free validators.

Read article

Amazon SES Cold Email for B2B: Compliance and Deliverability Setup (2026)

Legitimate B2B outbound on SES in 2026: sandbox exit, SPF/DKIM/DMARC, RFC 8058, Microsoft May 2025 bars, warm-up, and when Pro DIPs beat shared pools — with a first-party compliance checklist.

Read article

How to Migrate from SendGrid to Amazon SES (Step-by-Step)

Migrating from SendGrid to SES is mostly cheap — until your warm-up plan is wrong and deliverability falls off a cliff. DNS cutover, IP warming, API surface differences, and the deliverability checkpoints that keep email landing in inboxes through the switch.

Read article

Need help with this topic?

Our AWS-certified team implements, audits, and optimizes these services in production — from Bedrock RAG pipelines to multi-account landing zones.

Talk to AWS Experts