DMARC

How DMARC works

DMARC starts with a DNS TXT record at _dmarc on the organizational domain. That record states a policy for mail that claims the domain in the visible From header but fails SPF or DKIM alignment 1. Common policies are none for monitor-only, quarantine for spam-folder treatment, and reject for hard refusal 1.

Receivers authenticate with SPF and DKIM, then check whether those results align with the From domain under DMARC rules 1. If authentication and alignment fail, the published policy guides disposition. If they pass, DMARC is satisfied for that message path 1.

Amazon SES explains DMARC as an authentication protocol that uses SPF and DKIM so domain owners can reduce unauthorized use of their domains 2. SES documentation walks through aligning custom MAIL FROM domains and DKIM signing so outbound SES mail can pass DMARC for the brand From identity 2.

Reporting is the other half of DMARC. Aggregate reports summarize authentication results from participating receivers 1. Failure reports can flag individual problems. Teams use those feeds to find marketing tools, agencies, and spoof attempts that still send as the brand.

Outbound operators should not jump straight to reject. Start at p=none, fix every legitimate source until alignment is clean, then move to quarantine, then reject when the report stream stays quiet. Skipping that sequence is how a forgotten ticketing system suddenly stops delivering.

Sender reputation and domain reputation still need clean lists. DMARC stops some spoofing and clarifies policy. It does not invent inbox placement for a dirty blast. RichAPI Email verifier returns status and mxFound for 2 credits per verdict before volume rises 4. Misses bill zero 4. New accounts get 100 free credits 4.

Organizational domain policy can cover subdomains unless a subdomain publishes its own record 1. Sales subdomains used for cold outbound often need their own DMARC record so a strict root policy does not surprise a new ESP path. Spell that ownership out before the first cold wave.

Percentage tags and subdomain policy options exist for staged rollouts 1. Use them when a large brand cannot flip every business unit on the same day. Staged policy is still policy. It is not an excuse to ignore fail volume in the reports.

Why DMARC matters before tightening outbound

DMARC is the policy layer that makes SPF and DKIM actionable for the From domain recipients see 1. Without it, receivers may authenticate pieces of the message and still lack a clear owner instruction for failures.

Brand and security teams often own the DMARC record while sales owns the cold ESP. That split is fine when both sides share the report mailbox and the change calendar. It fails when sales adds a tool that never appears in the include list or the DKIM selectors.

Agencies should inventory every sender that uses the client From domain before proposing p=quarantine. Transactional mail, calendars, CRMs, and bill-pay systems are frequent surprises in the first month of aggregate reports 1.

Google asks senders to authenticate mail as part of its sender guidelines 3. DMARC is how authentication becomes an enforceable domain policy rather than a loose set of optional checks 2.

When reports show a spike in fail volume from one vendor, pause that stream first. Fix alignment. Confirm seeds. Only then restore volume. Pair the policy work with email warm-up on any new subdomain so a clean DMARC setup is not wasted on an overnight cold blast.

Feed aggregate reports into a weekly review with security and revenue ops in the same room. The goal is a shrinking list of unexplained fail sources, not a pretty dashboard. When the unexplained list is empty for a month, tightening policy is earned rather than hoped for 1.

Example of moving a domain from p=none to p=quarantine

A security lead publishes _dmarc with p=none and a rua address for aggregate reports 1. Two weeks of reports show a forgotten HR tool and a new agency ESP failing alignment. Both get SPF includes and DKIM selectors fixed through the ESP docs 2.

Seeds then pass SPF, DKIM, and DMARC alignment for the brand From domain 3. The policy moves to p=quarantine. A month later, with no legitimate sources left in the fail bucket, the team plans reject.

Before the next outbound campaign on a sales subdomain, the list is verified with RichAPI Email verifier 4. Bad rows leave. Verification costs 2 credits per verdict 4. Misses cost zero 4. The 100 free credits on a new account cover a small pilot of the same hygiene step 4.

Finance later asks to add an invoice tool that sends as the root domain. The security lead requires SPF and DKIM alignment evidence in a ticket before approval. The tool appears in the next aggregate report as pass traffic. That is DMARC operating as change control, not as a one-off DNS ticket.

DMARC vs SPF

DMARC publishes a From-domain policy on top of SPF and DKIM results. SPF alone authorizes envelope sending IPs without that policy layer.