DMARC

Definition

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT policy on _dmarc.example.com that tells receiving mail systems what to do when a message claiming your domain fails SPF and/or DKIM alignment. Policies climb a ladder: p=none (monitor), p=quarantine, p=reject. Aggregate (rua) and forensic (ruf) reports help you find unauthorized senders before enforcement.

When to use it

• Any domain that sends production email (transactional or marketing)
• Meeting Google/Yahoo/Microsoft bulk-sender minimums (at least p=none with working SPF+DKIM)
• As a prerequisite for BIMI (typically needs enforcement-level DMARC)

When not to use it

• Jumping straight to p=reject before all legitimate senders (ESPs, CRMs, ticketing) are aligned — you will quarantine your own mail
• Publishing DMARC without collecting and reading rua reports for several weeks

Tips

• Start at p=none, inventory failures, then raise pct and policy carefully
• Require alignment (organizational domain match) — SPF/DKIM “pass” alone is not enough for DMARC pass
• Prefer a dedicated reporting mailbox or SaaS parser; raw XML volume grows fast

Gotchas

Serious

• Multiple ESPs sending as @brand.com without DKIM/SPF alignment → enforcement blocks real campaigns
• Treating p=none as “done” forever while spoofing continues

Regular

• Forgetting subdomains (sp= policy) used by legacy apps

Related FactualMinds content

• BIMI on Amazon SES
• SPF · DKIM · BIMI · Amazon SES