Who this applies to#
- DMARC applies to domain owners publishing a policy and mail receivers evaluating messages that claim to use that domain
What DMARC requires#
- A DMARC pass requires either SPF or DKIM authentication to succeed with an identifier aligned to the domain in the message's From header
- Publishing a DMARC policy does not authenticate a message by itself. SPF or DKIM must provide the aligned authenticated identifier
Gmail
Gmail allows p=none for its minimum bulk-sender requirement, so monitoring can begin before moving to quarantine or reject
What this does not require#
- Gmail does not require a quarantine or reject policy for its minimum bulk-sender DMARC requirement. A policy of p=none is permitted
What passes and what does not#
Supported path
Authenticate with SPF or DKIM, align that authenticated identifier with the From domain, and publish a DMARC policy for the domain
Does not pass DMARC
Publishing a DMARC record without an aligned SPF or DKIM result does not produce a DMARC pass
Common mistakes#
- Treating the presence of a DNS record as proof that messages pass DMARC
- Moving directly to enforcement before checking which legitimate senders align
- Reviewing the policy but ignoring the domains used in visible From addresses
DMARC checklist#
- List every domain used in a visible From address
- Confirm that each legitimate sender passes aligned SPF or aligned DKIM
- Publish a DMARC record and begin with a policy suited to the rollout
- Review reports and correct legitimate alignment failures before stronger enforcement
OnVoard's take#
Treat DMARC as a rollout, not a DNS checkbox. Reports first. Fix alignment. Enforce last. That sequence protects legitimate senders while you make the receiving policy stricter.