Skip to main content
Cloud & AI Hub
Browse
Glossary AI Directory Playgrounds Models Prompts Explainers Strategy Matrix Benchmark Decoder
Security

DMARC Policy

The policy layer that ties SPF and DKIM to the visible From: address and tells receivers what to do on failure — now mandatory for bulk senders.

What is a DMARC policy?

DMARC is the enforcement and reporting layer atop email authentication. DKIM signs messages and SPF authorizes sending IPs, but neither checks the address users actually see. DMARC adds two things: alignment (the authenticated domain must match the visible From: domain, closing the spoofing gap SPF/DKIM leave open) and a published policy — p=none, p=quarantine, or p=reject — telling receiving servers what to do when authentication fails. Plus aggregate reports back to you, the discovery mechanism for who’s sending as your domain.

The rollout that avoids self-inflicted outages

Jumping to p=reject is how teams block their own invoices. The disciplined path is a ratchet: start at p=none (monitor only — mail flows normally, but you receive reports), read the reports for weeks to enumerate every legitimate sender (the marketing platform, the ticketing system, the CI alerts, that one forgotten billing tool), fix their SPF/DKIM alignment, then move to p=quarantine (failures to spam), and finally p=reject (failures bounced) once you’re confident. Skipping the monitoring phase means discovering your legitimate senders by their sudden silence.

Why it’s no longer optional

Google and Yahoo’s bulk-sender requirements made DMARC effectively mandatory for anyone sending volume — no DMARC, degraded deliverability or outright rejection. Beyond deliverability, p=reject is a genuine brand-protection control: it stops attackers spoofing your exact domain in phishing (they fall back to lookalike domains, which need separate defenses). BIMI (logo display) layers on top and requires enforcing DMARC, adding a marketing incentive to the security one.

What people get wrong

  • p=reject on day one — the fastest way to silence legitimate transactional mail.
  • Ignoring aggregate reports: they’re the tool for finding shadow senders, not compliance noise to filter away.
  • Assuming DMARC stops all phishing — it protects your exact domain; lookalikes and display-name spoofing route around it.

Primary source: RFC 7489 — DMARC

Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.