Overview
SPF and DKIM each verify something real, but each can pass on a technicality while the sender you see is still a lie. DMARC exists to close that gap. It is the last of the three standard checks, and often the decisive one.
How DMARC works
DMARC asks one question: does the domain that passed SPF or DKIM, the part of an address after the @, like yourbank.com, actually match the domain shown in the “From” line? A match is called alignment, and aligned mail passes. For everything else, the domain owner publishes instructions in advance: deliver it anyway, treat it with suspicion, or reject it outright.
Alignment is what makes the other two checks meaningful to a reader. A phisher can pass SPF for a domain they own while displaying your bank's name; what they cannot do is make their verified domain match your bank's. DMARC is the check that protects the one part of the message a person actually reads.
DMARC ties a verified sender to the one you see. Passing SPF or DKIM alone does not guarantee that link exists.
What a failure means
A DMARC failure means neither SPF nor DKIM produced a verified domain that aligns with the visible “From.” In other words, the identity on the letter could not be vouched for by anything on the envelope or the seal.
Innocent causes exist here too, usually inherited from the checks underneath: heavily forwarded mail, mailing lists that rewrite messages, or a sender whose IT setup was never finished. But because alignment is precisely the part attackers must fake, an outright DMARC failure on brand-shaped mail is one of the stronger warning signs in email.
What Sieve shows you
When Sieve files a message as Malicious and authentication is part of the reason, your dashboard names the failed check, and DMARC is one of the names you will see. The message is filed under a label in your Gmail, never deleted, so you can always open it and judge for yourself.
If you know the sender is real, drag the message back to your inbox (or restore it from the dashboard). One correction restores the message and teaches your own filter about that sender.
History and sources
DMARC did not start at a standards body. Between 2010 and 2011 a working group of companies with the most to lose from spoofed mail, including PayPal, the operators of Gmail and Hotmail, Yahoo Mail, several banks, and a handful of email-security vendors, coordinated through the newly formed dmarc.org and published the first DMARC specification on January 30, 2012 (dmarc.org's history page).
The IETF published DMARC as RFC 7489 in March 2015, but only as an Informational document on the Independent Submission stream: it recorded existing industry practice rather than an IETF-endorsed standard. That changed in May 2026, when the IETF replaced RFC 7489 with three standards-track documents, RFC 9989 for the core protocol, RFC 9990 for aggregate reporting, and RFC 9991 for failure reports, formally moving DMARC onto the IETF Standards Track for the first time.
Further reading: DMARC overview (dmarc.org)