What is RFC 7489 (DMARC)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
RFC 7489 is the 2015 document that first defined DMARC. In May 2026 it was replaced by RFC 9989 for the protocol, RFC 9990 for aggregate reports and RFC 9991 for failure reports. SPF checks the sending server. DKIM checks the message signature. Both are useful, but neither one helps ensure the email actually comes from the domain you see in the From field. That's the gap RFC 7489 was written to close.
RFC 7489 was the technical standard that defined DMARC (Domain-based Message Authentication, Reporting, and Conformance). At its core, it added one critical rule that SPF and DKIM don't enforce on their own: alignment. The domain authenticated by SPF or DKIM had to match the domain in the visible From address. If it didn't, DMARC treated the message as failing, even if SPF and DKIM individually passed.
That alignment check is what stops sophisticated spoofing. Without it, an attacker could send from a domain they control (passing SPF), while displaying your domain in the From field. Your recipients would see your name, not theirs.
RFC 7489 also gave domain owners a way to tell receiving servers what to do when a message failed. That was the policy part, and it had three settings:
- none. Take no action, just send reports. Good for monitoring while you're getting set up.
- quarantine. Send failing messages to the spam folder.
- reject. Block failing messages outright. This is full protection.
The third thing RFC 7489 defined was reporting. When a server received a message claiming to be from your domain, it could send you a report. Aggregate reports (rua) summarized what was passing and failing across all senders using your domain. Forensic reports (ruf) gave detail on individual failures. These reports are how you find out about misconfigured third-party senders or someone trying to impersonate your domain (and you'd be surprised how often that's happening quietly in the background).
In practice, a DMARC record lives in your DNS and looks something like this:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
That one line tells receiving servers your policy and where to send aggregate reports. If your people post to mailing lists, read this first, because p=reject can get that mail rejected. The current standard advises against it for those domains. Starting at p=none while you review reports is the sensible approach. Once you're confident your legitimate senders are all authenticating cleanly, you move to quarantine, then reject.
For today's rules, read "What is RFC 9989 (DMARC)?", "What is RFC 9990 (DMARC aggregate reporting)?" and "What is RFC 9991 (DMARC failure reporting)?". Still if you want to see what your DMARC record currently says (or whether you even have one), you can check it with our free DMARC Parser. And if you're starting from scratch, the DMARC Generator will build your first record in about 60 seconds.
The most useful email questions, once a month
One email a month. New questions worth reading, real deliverability changes (Gmail and Outlook updates, etc.), and any tool or report that landed since the last issue. No fluff, no upsell.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
