DMARC record

DMARC is the record that ties SPF and DKIM to the address a human actually sees. Both of the underlying mechanisms authenticate something other than the visible From: header — SPF authenticates the envelope sender, DKIM authenticates whatever domain signed the message — so on their own, neither stops somebody putting your domain in the From: line. DMARC adds the requirement that one of them must *align* with it.

The policy lives in p=. none asks receivers to do nothing differently and just send reports; quarantine asks for junk-foldering; reject asks them to refuse the message outright. Only the last two protect anything. A domain publishing p=none has DMARC configured and is not defended by it, which is a distinction worth being clear about, because a great many domains stop there and believe they are finished.

p=none is still the correct first step. It turns on the aggregate reports (rua=) that tell you which systems send as your domain and whether they authenticate — information you need before tightening, and which is very difficult to obtain any other way.

Alignment mode is the other half. Under the default relaxed alignment, a message from mail.example.com aligns with example.com; under strict (aspf=s, adkim=s), it does not. Strict alignment breaks more than people expect and is rarely worth it.

If there is no record, publish one at _dmarc.example.com starting at v=DMARC1; p=none; rua=mailto:dmarc@example.com. Nothing about mail delivery changes and the reports start arriving.

Read the reports for several weeks — long enough to catch monthly and quarterly senders like invoicing and payroll. For each legitimate source, get it to authenticate: into SPF if it has stable addresses, and DKIM-signing if the provider supports it, which is the more durable of the two because it survives forwarding.

Then move in stages: p=quarantine; pct=10, watch, raise the percentage, then p=reject. The staged move exists so that a sender you missed shows up as a small number of quarantined messages rather than a department discovering on a Monday that none of its mail arrived.

Keep reading the reports afterwards. A new SaaS tool sending as your domain is a change to your mail estate, and the aggregate report is where it shows up first.