What Does DMARC PASS Mean?

DMARC is the check that links authentication to the address people actually see. A pass tells you that the domain in the From header is the one that authenticated. That is valuable, and it is also narrower than it sounds.

How a DMARC pass is decided

1. Take the domain from the From header.
2. Check whether SPF passed and the SPF domain (Return-Path) aligns with it.
3. Check whether DKIM passed and a signing domain (d=) aligns with it.
4. If either aligned check passes, DMARC passes. If neither does, it fails and the domain's policy applies.

Alignment

Working out the organizational domain properly needs the Public Suffix List. The Email Header Analyzer uses a short built-in list of common suffixes, so it labels relaxed alignment as approximate.

Reading a result

Authentication-Results: mx.example.net;
        spf=pass [email protected];
        dkim=pass header.d=example.com;
        dmarc=pass (p=REJECT) header.from=example.com

Here SPF passes for another domain and does not align, but DKIM passes for example.com, which aligns, so DMARC passes. The p=REJECT note is the policy the receiver saw, as reported in a comment.

Policies

• p=none: monitor and report, take no action.
• p=quarantine: treat failing mail as suspicious, for example send it to spam.
• p=reject: ask receivers to reject failing mail.

What a pass does not mean

DMARC pass shows that the domain in From authorized the message. It does not show the sender is honest, that the content is safe, or that a look-alike domain was not used. A message from a criminal-owned domain can pass completely. Conversely, a legitimate message can fail DMARC if a forwarder breaks both SPF and DKIM.

For the full comparison, see SPF vs DKIM vs DMARC Explained. To review other headers that protect websites, try the HTTP Security Headers Analyzer.