DNSFetch

DMARC explained

DMARC answers two questions receivers actually care about: did this message authenticate as the domain in From, and what should we do if it did not?

Publish a TXT record at _dmarc.example.com beginning v=DMARC1. The p= tag is the policy for the organizational domain. Optional sp= covers subdomains. rua is where nightly aggregate XML reports go. Those reports are how you discover the forgotten ticket system still sending as you from a random ESP.

Alignment

SPF must pass and the envelope domain must align with From. DKIM must pass and the d= domain must align with From. Relaxed alignment allows a subdomain; strict (aspf=s / adkim=s) requires an exact match. DMARC passes if at least one aligned mechanism passes (unless you are in an unusual setup that expects both).

A rollout that does not page you at 2 a.m.

  1. p=none plus a rua mailbox or a report vendor.
  2. Fix sources that show up unauthenticated: add SPF includes, rotate DKIM, stop sending from hosts you do not control.
  3. p=quarantine with pct=10 if you are cautious, then 100%.
  4. p=reject when the unknown pass volume is near zero.

BIMI and some inbox brand indicators expect reject. Consumer mailbox providers increasingly treat missing DMARC as a spam signal even before reject. Generate a record with the DMARC generator, then check it.