Email & DNS guide
DMARC, without the jargon
Understand policy, alignment and reports before changing how your domain handles unauthenticated email.
The question DMARC answers
A message can say it is from your business while being sent by someone else. DMARC connects the visible From domain to a successful SPF or DKIM authentication result. This connection is called alignment. Either aligned SPF or aligned DKIM can satisfy DMARC; both are not required to pass every message.
Three policy choices
The p tag describes the requested treatment of failing mail. none observes, quarantine requests suspicious handling, and reject requests rejection. Receivers retain discretion. A valid record alone does not prove your messages authenticate, and a monitoring policy does not request enforcement.
Use reports to inventory senders
Aggregate reports can help you recognize your usual sending services and unexpected sources. Make a list of business mail, billing systems, support platforms and marketing tools. Investigate unrecognized sources before assuming every failure is malicious. Forwarding and mailing lists can complicate authentication.
Make a controlled change
Keep a copy of the existing record. Confirm legitimate sources have aligned authentication, introduce enforcement deliberately, and watch reports and support channels after each change. Keep a rollback plan. If you use an external report address, follow the reporting provider's authorization instructions.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.