DMARC policy progression
Move from observation to enforcement using evidence from every legitimate sender.
Understand the passing condition
DMARC passes when a qualifying SPF or DKIM result passes and its authenticated domain aligns with the visible From domain. Passing both is useful operationally, but a DMARC pass does not require both aligned mechanisms. Strict alignment requires an exact domain match; relaxed alignment follows the organizational-domain rules in the specification.
Choose a policy deliberately
| Policy | Requested treatment for DMARC failure | Readiness check |
|---|---|---|
| none | No DMARC-specific enforcement request | Inventory legitimate sending routes and arrange reporting. |
| quarantine | Treat failing messages as suspicious | Verify forwarding, third-party senders and operational exceptions. |
| reject | Reject failing messages | Confirm legitimate routes authenticate and align; establish a rollback owner. |
Publish an observation policy
This is a valid minimal TXT value at the DMARC record name for your domain. It requests no enforcement and does not request reports. Add a real, controlled reporting destination only after arranging report processing and any required external-destination authorization.
v=DMARC1; p=noneUse evidence to advance
- Inventory the From domains, sending platforms and aligned identifiers used by each production stream.
- Arrange aggregate reporting and compare observed sources with the inventory. Investigate unrecognized sources instead of treating every failure as an attacker.
- Repair legitimate routes, then change the policy through your DNS change process. Monitor both reports and actual delivery failures.
- Document recovery ownership before stronger enforcement. Base the decision on verified sending routes and delivery evidence.
RFC 9989 is the current DMARC specification. When reviewing older guidance, check whether its tags and policy-discovery assumptions still apply.