Glossary
DMARC: what it is and how to set the right policy
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email policy standard that tells receiving servers what to do with messages that fail SPF and DKIM alignment: deliver, quarantine or reject them. It also provides reports on who is sending email using your domain, authorized or not.
How does DMARC work?
DMARC is published as a TXT record in DNS and works on top of SPF and DKIM. For a message to pass, at least one of the two must pass and be aligned with the domain the recipient sees in the "From" header. That alignment requirement is the key difference: SPF and DKIM can each pass on technical domains the user never sees, while DMARC ties authentication to the visible identity of the sender.
The policy tag tells receivers how to treat failures — "none" (deliver and report), "quarantine" (send to spam) or "reject" (refuse delivery) — and the reporting tags request aggregate feedback. Mature setups evolve from monitoring to enforcement as legitimate sending sources are identified and fixed.
Why it matters in B2B
For outbound programs, DMARC is both a compliance requirement and a diagnostic tool. Providers increasingly downgrade or reject unauthenticated mail from bulk senders, so a missing policy directly harms deliverability. At the same time, DMARC reports expose problems that are otherwise invisible: a CRM sending unsigned notifications, an old marketing tool still active, or a third party spoofing the brand to phish customers.
Consider a hypothetical professional services firm whose proposals occasionally land in clients' spam folders. Nobody can explain why until DMARC monitoring reveals that a billing platform added years ago never signed its messages, dragging down the domain's authentication record. One DNS fix later, the mystery disappears.
Reviewing DMARC alignment is a standard step in AVANTAI's outbound audit, and every sending domain in its AI outbound systems launches with a monitored policy from day one.
Frequently asked questions
Which DMARC policy should I start with?
Start with 'p=none' to collect reports without affecting delivery, review which legitimate sources are failing alignment, fix them, and then move progressively to 'quarantine' and finally 'reject'. Jumping straight to reject without analysis can block your own legitimate email.
Is DMARC mandatory?
For senders to major providers it effectively is. Google and Yahoo's bulk sender requirements, in force since 2024, ask for a DMARC policy on the sending domain along with SPF and DKIM. Without it, inbox placement suffers and rejection becomes likely at volume.
What do DMARC reports tell me?
Aggregate reports show which servers are sending email under your domain and whether those messages pass SPF and DKIM alignment. They reveal forgotten tools, misconfigurations and spoofing attempts, which makes them the main instrument for tightening the policy safely.