DMARC

SPF authenticates the envelope sender — a technical address the recipient never sees. DKIM signs the message with a domain's key. Either can pass while the visible From: shows a completely different domain.

DMARC requires that a passing SPF or DKIM result belongs to the same domain as the From: header. That is alignment, and it is what makes DMARC the mechanism that actually stops exact-domain spoofing.

A message can pass SPF and still fail DMARC. This surprises people, and it is the design working as intended.

`p=none`: take no action, but send reports. This is a monitoring mode, not protection — and it is where most domains stop, which means they have the reports and none of the benefit.

`p=quarantine`: treat failing mail as suspicious, typically delivering it to spam.

`p=reject`: refuse it outright. The end state, and the only one that prevents spoofing.

`pct=` applies the policy to a fraction of messages, which is how a move to quarantine or reject is rolled out gradually.

Publish `p=none` with a `rua=` address and collect aggregate reports for several weeks. They will name senders you did not know about — a CRM, a ticketing system, a payroll provider.

Fix each legitimate sender so it aligns: add it to SPF, or set up DKIM signing with your domain.

Move to `p=quarantine`, initially with a low `pct=`, and watch the reports.

Move to `p=reject` once the reports show only illegitimate mail failing.

Rushing this rejects your own invoices. Staying at `p=none` indefinitely protects nothing.

`dig _dmarc.example.com TXT +short`. The record lives on the `_dmarc` subdomain, not the apex, which is a frequent source of "we published it and nothing happened".

Check `p=`, whether `rua=` is present, and whether a `sp=` subdomain policy is set — subdomains inherit the organisational policy unless told otherwise.

Aggregate reports arrive as gzipped XML, once a day, from each receiving provider that supports them. They are not readable without processing, which is why they are so often published and then ignored.

Each report lists source IP addresses, the volume sent from each, and whether SPF and DKIM passed and aligned. That is enough to identify every system sending in your name — which is the information nobody has before they start.

What they do not contain is message content or recipient addresses. An aggregate report is a count, not a copy.

Forwarded mail shows up as a consistent SPF failure with a DKIM pass, because forwarding rewrites the envelope and leaves the signature intact. Recognising that pattern prevents a long investigation into a non-problem.

A `ruf=` address requests per-message forensic reports instead. Few providers send them, and they can carry personal data, so most domains set `rua=` only.