DMARC Policy

What is a DMARC policy?

DMARC is the enforcement and reporting layer atop email authentication. DKIM signs messages and SPF authorizes sending IPs, but neither checks the address users actually see. DMARC adds two things: alignment (the authenticated domain must match the visible From: domain, closing the spoofing gap SPF/DKIM leave open) and a published policy — p=none, p=quarantine, or p=reject — telling receiving servers what to do when authentication fails. Plus aggregate reports back to you, the discovery mechanism for who’s sending as your domain.

The rollout that avoids self-inflicted outages

Jumping to p=reject is how teams block their own invoices. The disciplined path is a ratchet: start at p=none (monitor only — mail flows normally, but you receive reports), read the reports for weeks to enumerate every legitimate sender (the marketing platform, the ticketing system, the CI alerts, that one forgotten billing tool), fix their SPF/DKIM alignment, then move to p=quarantine (failures to spam), and finally p=reject (failures bounced) once you’re confident. Skipping the monitoring phase means discovering your legitimate senders by their sudden silence.

Why it’s no longer optional

Google and Yahoo’s bulk-sender requirements made DMARC effectively mandatory for anyone sending volume — no DMARC, degraded deliverability or outright rejection. Beyond deliverability, p=reject is a genuine brand-protection control: it stops attackers spoofing your exact domain in phishing (they fall back to lookalike domains, which need separate defenses). BIMI (logo display) layers on top and requires enforcing DMARC, adding a marketing incentive to the security one.

What people get wrong

• p=reject on day one — the fastest way to silence legitimate transactional mail.
• Ignoring aggregate reports: they’re the tool for finding shadow senders, not compliance noise to filter away.
• Assuming DMARC stops all phishing — it protects your exact domain; lookalikes and display-name spoofing route around it.

Primary source: RFC 7489 — DMARC

DMARC Enforcement Levels

A DMARC record specifies one of three policies for how receiving mail servers should handle messages that fail alignment: none (take no action, just generate reports — often used as an initial monitoring phase before enforcing stricter handling), quarantine (typically routes failing messages to a spam folder), and reject (block the message entirely). Major mailbox providers including Google and Yahoo now require bulk senders to have a DMARC policy in place at all, reflecting how central DMARC has become to modern email deliverability — a domain without one risks having its legitimate mail flagged as suspicious, independent of whether it’s actually being spoofed by anyone.