Do Google and Yahoo require DMARC?

Yes. Since February 2024, Google and Yahoo require DMARC for bulk senders (5,000+ messages per day). DMARC is a deliverability best practice for all senders.

Reviewed by: QuickDMARC Security Team · Email Authentication Specialists · Last reviewed: 2026-08-31

What is DMARC?

Q: What does DMARC stand for?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance, defined in RFC 7489.

Q: What DMARC policy should I start with?

Start with p=none to monitor authentication results without enforcement. After validating legitimate senders for 2–4 weeks, move to p=quarantine, then p=reject.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol defined in RFC 7489, updated by RFC 9989. It builds on SPF (RFC 7208) and DKIM (RFC 6376) to tell receiving mail servers how to handle messages that fail authentication and provides aggregate reports on mail sent using your domain.

Organizations publish a DMARC DNS TXT record at _dmarc.yourdomain.com with a policy of p=none (monitor), p=quarantine, or p=reject. Google and Yahoo require DMARC for bulk senders (5,000+ messages/day) as of February 2024.

How DMARC works

Email is sent claiming to be from your domain.
The receiving server checks SPF and DKIM alignment against the From domain.
Your DMARC policy tells the receiver to accept, quarantine, or reject failures.
Aggregate reports (RUA) show which senders pass or fail authentication.

DMARC policy comparison

Policy	Behavior	When to use
`p=none`	Monitor only; no enforcement	Initial deployment; discover legitimate senders
`p=quarantine`	Failed mail sent to spam/junk	Intermediate step before full rejection
`p=reject`	Failed mail blocked entirely	Maximum protection after sender validation

Subdomain policies (sp=)

The sp= tag sets DMARC policy for subdomains separately. If omitted, subdomains inherit p=. Use sp=reject when you do not send mail from subdomains to prevent subdomain spoofing.

Alignment: strict vs relaxed

Relaxed alignment (aspf=r, adkim=r) allows organizational domain matches. Strict alignment (aspf=s, adkim=s) requires exact domain matches — harder with third-party senders.

DMARC DNS record example

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=r

Frequently asked questions

What DMARC policy should I start with? Start with p=none for 2–4 weeks of monitoring, then move to quarantine and reject.

How does QuickDMARC implement DMARC? Publish one CNAME at _dmarc.yourdomain.com → QuickDMARC hosts the live TXT record and receives reports at your unique RUA address.