What is DMARC Policy?
A DNS rule telling receivers how to treat mail that fails SPF and DKIM alignment: monitor, quarantine, or reject. Published reports then reveal exactly who sends as your domain, legitimate or not.
Example
After SPF and DKIM pass consistently, the domain publishes a DMARC policy moving from monitoring to quarantine and finally reject. Aggregate reports then show exactly which services still send unauthenticated mail.
What people get wrong
Jumping straight to a reject policy on day one. Legitimate flows such as forwarding break first; ramp through monitoring so reports reveal every sender before enforcement.
Frequently asked questions
What breaks most often under DMARC enforcement?
Forwarded mail and unauthenticated third-party senders. Inventory every service that sends as your domain during monitoring, then authenticate or remove each one.
Related terms
SPF Record
A DNS TXT entry naming the mail servers allowed to send for a domain, checked against the envelope sender. Receivers distrust or reject mail from unlisted servers, so publishing SPF is step one of authentication.
DKIM Signing
Cryptographic email signing where the sender attaches a signature header verified against a DNS-published public key. Passing DKIM proves the message survived transit unmodified and truly came from the domain holder.
Return-Path Alignment
Matching the envelope sender domain used for SPF with the visible From domain that recipients see. Aligned domains let inbox providers credit authentication to the brand instead of the sending platform.
Sender Reputation
The trust score mailbox providers assign to a sending domain or IP from engagement, complaints, and authentication history. High reputation lands in the inbox; low reputation diverts identical content to spam.
Sender Identity
The verified domain or address a provider is permitted to send from, proven through DNS records. BYOB projects verify sending domains before campaigns so transactional mail leaves from a trusted name.
DNS Verification (TXT)
Proving domain ownership by publishing a provider-issued token as a DNS TXT record. BYOB custom-domain and sender setup both use this challenge before activating routing or sending.