DMARC ties SPF and DKIM to the From address a recipient actually sees, and tells receivers what to do when neither passes. It is also the record most likely to be published and then quietly left doing nothing, because the safe starting value, p=none, requests no enforcement at all.
What to look at
| Tag | What it means | What you want |
|---|---|---|
v=DMARC1 |
Version, must be first | Present |
p= |
Policy: none, quarantine or reject | quarantine or reject eventually |
rua= |
Where aggregate reports are sent | A mailbox you actually read |
pct= |
Percentage of mail the policy applies to | 100 at the end state |
sp= |
Policy for subdomains | Set it, or subdomains inherit and surprise you |
aspf / adkim |
Alignment strictness | Relaxed is fine for most senders |
The record lives at _dmarc.yourdomain.com, and there should be exactly one.
Alignment, which is the part people miss
DMARC does not simply ask whether SPF or DKIM passed. It asks whether the domain that passed matches the From domain the recipient sees. That is alignment, and it is why mail can pass SPF and still fail DMARC: the envelope sender was your ESP’s domain, not yours.
Practically, this means SPF alignment often fails for third-party senders while DKIM alignment holds, another reason DKIM signing on your own domain matters more than SPF for cold email.
p=none is monitoring, not protection
With p=none you get reports and nothing else. Anyone can still spoof your From address and receivers will not act on it. That is the correct place to start, you need the reports to discover senders you forgot, but it is a stage, not a destination.
The rollout that works: publish p=none with a rua address, read reports for two to four weeks until every legitimate sender authenticates and aligns, move to p=quarantine with pct= stepped up gradually, then p=reject at 100%. The full staged rollout, with what to watch at each step.
What DMARC does for a cold sender
Three things. It is expected: Gmail and Yahoo’s bulk sender requirements ask for it, and its absence is a mark against you. It protects the domain from being spoofed, which matters more once your domain is visible enough to be worth impersonating. And the aggregate reports are the only view you get of every service sending as your domain, which is regularly a surprise.
What it does not do is improve placement by itself. Authentication removes reasons to be filtered; it does not add reasons to be delivered. The causes that actually decide placement.
Next: rolling DMARC out safely, checking SPF, or grading all four records at once.
Frequently asked questions
How do I check my DMARC record?
Look up the TXT record at _dmarc.yourdomain.com. Confirm there is exactly one, that it starts v=DMARC1, and check the p, rua, pct and sp tags.
What does p=none mean?
It requests no enforcement. You receive reports, but receivers take no action against unauthenticated mail claiming to be from your domain. It is the right starting state and a poor end state.
What is DMARC alignment?
DMARC asks whether the domain that passed SPF or DKIM matches the From domain the recipient sees. Mail can pass SPF and still fail DMARC if the envelope sender was your provider’s domain rather than yours.
Do I need DMARC for cold email?
Yes. Gmail and Yahoo’s bulk sender requirements expect it, its absence counts against you, and the aggregate reports are the only complete view of what sends as your domain.
Does DMARC improve deliverability?
Not by itself. Authentication removes reasons to be filtered rather than adding reasons to be delivered.