DMarkyMARC

DMARC tells receiving mail servers what to do with mail that claims to come from your domain but fails authentication, and asks them to report back on it daily. Those reports are the only way to see who is sending as you: your own systems, the platforms you forgot about, and the forgeries.

A record can pass a syntax checker and still protect nothing. The common ways:

• p=reject with pct=0 or a low pct, so the policy is announced but almost never applied.
• sp=none, which exempts every subdomain — where forged mail usually comes from.
• Reports sent to a mailbox nobody reads, or to the domain being checked.
• Reports sent to another company's domain without the authorization record on their side, so every report is silently discarded.

All four look finished and deliver nothing, which is worse than an honest p=none. Nothing bounces and no error appears; the reports simply never arrive.

Going the other way costs real mail. Do not jump to p=reject until SPF and DKIM alignment is verified for every legitimate sender. Fix alignment first, watch the reports until they are clean, then tighten.

The DSG baseline

A domain PASSES when it enforces — p=quarantine or p=reject — and its reports reach somewhere we actually read. WARN means it does that, but one destination still needs cleaning up.