DMARC is a policy and reporting layer for email authentication. Publishing a strict policy before discovering every legitimate sender can block valid invoices, receipts or support emails. A safer project starts with visibility and moves toward enforcement only after measuring what actually sends mail.
The three prerequisites
- SPF: The receiving system checks whether the sending host is authorized for the envelope sender domain.
- DKIM: A message carries a cryptographic signature linked to a signing domain.
- Alignment: For DMARC to pass, a passing SPF or DKIM result needs an aligned domain relative to the visible From header. A pass for an unrelated provider domain is not enough.
The protocol is defined in RFC 7489. The exact supported reports and delivery details vary by receiver.
A staged deployment
| Stage | What to do | Exit condition |
|---|---|---|
| Inventory | List direct mail, transactional mail, marketing, forwarding and support services | Each sender has an owner |
| Monitor | Publish a DMARC policy with p=none and a reporting destination you control | Real traffic is represented |
| Investigate | Classify reports, fix misalignment and retest affected services | Expected streams consistently authenticate |
| Ramp | Consider a limited quarantine rollout where supported | No unexplained legitimate failures |
| Enforce | Consider reject once evidence supports it | Ownership and monitoring continue |
Before interpreting aggregate reports, remember that forwarding, mailing lists, shared services and receiver differences create edge cases. Do not treat a single day of clean reports as comprehensive proof.
An example record shape
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Replace these illustrative names with a mailbox or processor you actually operate. Reports can contain operational metadata: choose retention and access controls deliberately.
Use NexKit Network Tools to inspect public DNS, SPF, DKIM and DMARC records. Combine those observations with provider dashboards and message headers before changing production policy.
Important: DMARC settings should follow a verified sender inventory; this checklist is not a recommendation to change every domain to p=reject immediately.