DMARC — tying it together

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receivers what to do with mail that fails SPF or DKIM, and gives you reports on who is sending in your name. It is the policy layer on top of the other two.

A DMARC record on your domain has two jobs: it sets a policy ("if a message fails SPF and DKIM, please reject it / quarantine it / let it through anyway") and it requests aggregate reports so you can see which servers are sending under your domain — both legitimate ones you may have forgotten and abusers trying to spoof you.

A safe rollout plan

1. Start with p=none. This monitors and reports without affecting delivery — you find out who is sending in your name before changing any policy.
2. Read the aggregate reports for a few weeks (they arrive as XML attachments to the address in your DMARC record — many providers offer dashboards that parse them for you).
3. Once you have SPF and DKIM set up for every legitimate sender, move to p=quarantine — mail that fails both lands in spam.
4. After you are confident nothing legitimate is being mis-flagged, move to p=reject. Failed mail is bounced outright. This is the strongest protection against spoofing.

🚧

Do not jump straight to p=reject

Going from no DMARC to p=reject in one step can block legitimate mail from systems you forgot about (HR notifications, invoicing tools, support ticketing). The staged rollout (none → quarantine → reject) exists exactly to surface those before they bite you.

📘

Gmail and Yahoo now require DMARC for bulk senders

Since 2024, Gmail and Yahoo require a DMARC record on the sending domain for anyone sending more than 5 000 messages a day. Without it, your campaigns will be rejected by those mailbox providers. Even small senders should have at least p=none in place — the cost is nil and you start collecting reports.

What does p=none, p=quarantine, and p=reject mean?

p=none monitors without affecting delivery, p=quarantine sends failures to spam, p=reject bounces them outright. The standard rollout is none → quarantine → reject as confidence grows.

Do I need DMARC if I already have SPF and DKIM?

Yes. DMARC tells mailbox providers what to do when SPF/DKIM fail and gives you reports on who is sending in your name. Without DMARC, SPF and DKIM are advisory; with DMARC they have teeth.

Will jumping straight to p=reject break anything?

Potentially yes. Any legitimate system you forgot about (HR notifications, invoicing tools, ticketing) that sends from your domain will be blocked. The staged rollout surfaces those first so you can fix them.

Why are Gmail and Yahoo enforcing DMARC now?

Since 2024 both require a DMARC record on the sending domain for anyone sending more than 5 000 messages a day. Without it your campaigns are rejected by their mail servers — DMARC has become a baseline cost of doing email at scale.

See also

• SPF — authorising senders
• DKIM — signing your mail
• What is a campaign