What is DMARC?
DMARC, Domain-based Message Authentication, Reporting and Conformance, connects email authentication to the domain visible in the message From field. The standard uses SPF or DKIM together with alignment, meaning the authenticated identity matches the visible sender domain.
DMARC also includes reporting. Reports help you see which systems send with your domain and whether messages pass the checks. This makes DMARC both a safeguard and a way to understand your email environment.
What p=none does and does not do
With p=none, you do not ask the recipient to reject or quarantine a message because of its DMARC result. The policy is therefore mainly a starting point for inventory and report analysis, not the final protection goal.
p=none does not guarantee delivery. The recipient can still filter email for other reasons. It does not sharpen the DMARC-based handling of failed authentication either.
The path from p=none to p=reject
Start by inventorying every legitimate sender, including CRM, billing, newsletters, support and other external systems. Then check SPF, DKIM and alignment for each flow. A technical SPF or DKIM pass is not enough if the identity is not aligned with the visible From domain.
When report data shows that legitimate flows work, the policy can move to p=quarantine and later p=reject. Use actual sending cycles and representative reports rather than simply counting days. Continue monitoring after p=reject because new systems and senders are added over time.
- Inventory senders
- Correct SPF, DKIM and alignment
- Analyse reports
- Tighten policy gradually
- Continue monitoring
Common mistakes to avoid
A common mistake is moving directly to p=reject without knowing every sender. Another is assuming p=reject stops every form of fraud. DMARC is a policy to the recipient for the exact domain and does not generally protect against lookalike domains or other methods.