Does DMARC validation occur before or after email delivery?

The short answer is that DMARC validation happens during the email delivery process, but before an email is officially accepted and placed into a user's mailbox (like the inbox or spam folder). Think of it as a security checkpoint at the border of a mail server. The check happens right when a message arrives, not after it's already been let in.

To fully understand this, it's important to know that DMARC doesn't work alone. It's built on top of two other email authentication standards: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). As Higher Logic explains, DMARC uses these two protocols to verify an email's authenticity and then tells receiving servers what to do if the checks fail.

Higher Logic says:

Visit website

DMARC uses SPF and DKIM and provides a set of instructions to receiving email servers with what to do if they receive unauthenticated mail.

Suped DMARC monitor

Free forever, no credit card required

Get started for free

Trusted by teams securing millions of inboxes

When an email is sent, a multi-step conversation happens between the sending mail server and the receiving mail server. The DMARC check is a critical part of this initial handshake.

• Email is sent: You hit send on an email. Your mail server contacts the recipient's mail server to begin the delivery process.
• Initial checks (SPF and DKIM): The receiving server immediately checks the email for SPF and DKIM signatures. It looks up the sender's DNS records to see if the sending IP address is authorized (SPF) and if the email's signature is valid (DKIM).
• DMARC check: After the SPF and DKIM checks are complete, the server then looks for a DMARC record in the DNS of the domain found in the "From" address. This record tells the server what to do.
• Policy enforcement: The server compares the SPF and DKIM results against the DMARC policy. If the email fails DMARC alignment and the policy is p=reject, the receiving server can reject the email immediately, ending the connection. The email is never delivered. If the policy is p=quarantine, the server accepts the email but will likely deliver it to the spam folder. If the policy is p=none, the email is delivered normally, but a report is sent to the domain owner about the result.

SiteGround says:

Visit website

The DMARC policy is communicated through a TXT record in the domain's DNS and is checked by the recipient's server after SPF and DKIM evaluations.

The key takeaway is that DMARC provides instructions for how a server should handle an email *as it arrives*. The validation itself is part of the real-time communication between servers. A strict DMARC policy (p=reject) acts as an immediate bouncer, preventing a fraudulent email from ever being technically "delivered" or stored on the receiving server.

For policies like p=quarantine, the validation still happens before final placement. The server accepts the message but uses the DMARC failure as a strong signal to put it in the spam folder instead of the inbox. This increases the likelihood that only legitimate, authenticated emails reach the recipient's main view, as noted by DuoCircle. So, while the message is technically delivered in this case, its final destination is determined by the DMARC check that happened moments earlier.

DuoCircle says:

Visit website

If your domain complies with DMARC, it increases the likelihood of email providers delivering your emails to the inboxes rather than the spam folder...

In summary, DMARC validation is a proactive security measure. It happens at the very front line of email delivery, giving receiving servers the power to reject or filter unauthenticated mail before it poses a risk to the end-user.