What is DMARC?
DMARC builds on two older mechanisms. `SPF` states which servers may send for your domain, `DKIM` signs the message cryptographically. Neither says anything about what a receiver should do when the check fails. That is what DMARC adds, and it introduces a second condition: the domain in the visible From line must line up with the domain that SPF or DKIM confirmed. This alignment is why a technically valid signature can still fail the check.
The record has three levels. `p=none` means report and nothing else, `p=quarantine` sends suspect messages to the spam folder, `p=reject` refuses them outright. The point that matters in practice: the requirements of the large mailbox providers are already satisfied at `p=none`, yet nobody is protected by it. Two further tags decide as much: the address behind `rua` receives the daily aggregate reports, and `sp` sets a separate level for subdomains, which matters because sending services usually deliver from one.
The order of the rollout is decisive and routinely skipped. First publish the record at `p=none` with an `rua` address, then read the reports for four weeks and find every service that sends in your name: sending tool, accounting, booking system, ticket system, the website contact form. Only once that list is complete and every service signs cleanly does the move to `quarantine` happen without collateral damage. Jumping straight to `reject` reliably stops your own invoice emails too.
Why does DMARC matter?
Since 1 February 2024 Google has required a DMARC record from every sender above 5,000 messages a day to personal Gmail accounts; Microsoft followed on 5 May 2025 for outlook.com, hotmail.com and live.com and now refuses non-compliant mail with a dedicated error code. How far compliance and effect sit apart shows in our own DNS query of the 20 ATX domains on 15 August 2026: 18 publish a record, but only 10 sit at a level that instructs the receiver to do anything at all.
DMARC in practice
- 01An agency publishes `p=none` with a collection address, reads reports for four weeks and discovers an old accounting tool that has been sending unsigned invoices in its name for years.
- 02A business sits at `p=reject` but sends its newsletter from `news.company.com`. With no `sp` tag set, the subdomain inherits the strict level, and a misconfigured sending service produces outright refusals rather than a warning.
- 03A fraudster sends invoices using a supplier's address in the From field. If that domain sits at `quarantine` or `reject`, receivers filter those messages out without anyone having to intervene.
