# DMARC: connect authentication to your From domain

> Understand DMARC alignment, the difference between a message result and a published policy, and how to investigate your report.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Reviewed: 2026-11-06.

## A pass needs an authenticated, aligned identity

DMARC connects the visible From domain with SPF or DKIM. At least one passing mechanism must use an identity that aligns with From. Two passing mechanisms on unrelated provider domains do not establish that connection.

Strict alignment requires identical domains. Relaxed alignment uses the same organizational domain. The policy can set these modes separately for SPF and DKIM.

- [Work through a fictional alignment failure](https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail)

## Separate the message verdict from the policy

A DMARC policy describes the domain owner’s requested treatment of failing mail. It is different from the pass or fail result for one message. Receivers also make their own handling decisions.

CheckDMARC tests individual messages. It does not collect your domain’s aggregate DMARC reports or establish that every legitimate sender is ready for enforcement.

Common policy values
| Policy | Requested handling for failures |
| --- | --- |
| p=none | Monitoring; no DMARC-based change to handling is requested. |
| p=quarantine | Treat failing mail as suspicious. |
| p=reject | Reject failing mail. |

- [Plan a sending-service inventory](https://checkdmarc.mx/blog/email-authentication-checklist)

## DMARC’s 2026 specifications

The May 2026 specifications separate the core DMARC protocol in RFC 9989 from aggregate reporting in RFC 9990 and failure reporting in RFC 9991. All three are Standards Track documents with Proposed Standard status; together they replace RFC 7489.

RFC 9989 changes policy discovery and organizational-domain determination, introduces tags including np, psd and t, and removes pct from the core specification. A published RFC does not establish which rules a particular receiving service implements.

- [What RFC 9989 changes for email senders](https://checkdmarc.mx/blog/dmarc-2026-rfc-9989)

## Use CheckDMARC as a diagnostic

Read the receiver’s reported DMARC result alongside the SPF and DKIM identities. Where receiver results are absent, the tool can provide a computed diagnostic; its relaxed-alignment display is not a complete receiver implementation or a strict-policy conformance test.

The current core specification is RFC 9989, published in May 2026. Reading current documentation does not imply that every receiver or this diagnostic implements every part of that specification. Use the original receiving system’s evidence for delivery investigations.

- [Understand the test’s limits](https://checkdmarc.mx/how-it-works#limits)
- [Start a new check](https://checkdmarc.mx/#email-check)

## Sources

- [RFC 9989 — DMARC (May 2026), including changes from RFC 7489 (Appendix C)](https://www.rfc-editor.org/rfc/rfc9989.html)

- [RFC 9990 — DMARC Aggregate Reporting](https://www.rfc-editor.org/rfc/rfc9990.html)

- [RFC 9991 — DMARC Failure Reporting](https://www.rfc-editor.org/rfc/rfc9991.html)

## Related reading

- [DMARC in 2026: what RFC 9989 changes for email senders](https://checkdmarc.mx/blog/dmarc-2026-rfc-9989/index.md)

- [SPF: check which servers can send for your domain](https://checkdmarc.mx/learn/spf/index.md)

- [DKIM: understand the signature on your email](https://checkdmarc.mx/learn/dkim/index.md)

- [Authentication passes. Why can email still land in spam?](https://checkdmarc.mx/blog/authentication-pass-not-inbox-guarantee/index.md)

[Check your email](https://checkdmarc.mx/#email-check)

Web page: https://checkdmarc.mx/learn/dmarc