DMARC connects authentication to the domain people see in a message’s From address. A passing, aligned SPF or DKIM result can satisfy DMARC; merely publishing both records is insufficient.
- Inventory legitimate sending services and verify their SPF or DKIM alignment with your From domain using real message headers.
- Run the DMARC check for that domain. The exact-name record lives at
_dmarc.domainand starts withv=DMARC1. The checker does not discover inherited policy from ancestors. - Use a reporting mailbox or service you control. Start with a monitoring policy,
p=none, while reviewing reports. Monitoring does not request blocking. - Repair legitimate services that fail alignment. Third-party reporting destinations may require separate authorization records; confirm those with the reporting service.
- When the evidence supports it, work with your provider to stage quarantine and then rejection. Document a rollback and review subdomain policies before changing them.
Receivers retain local handling choices. No DNS-only check guarantees inbox placement. The current DMARC specification replaces RFC 7489; deployed receivers may support different generations, so confirm rollout behavior with your provider.
Reference: DMARC specification (RFC 9989).