Key points
- DMARC tells receivers what to do with mail that fails SPF/DKIM
- Policies: none → quarantine → reject (roll out gradually)
- Also gives you visibility reports on spoofing
- You must have SPF + DKIM first
How to do it
- Start with p=none and a reporting address
- Monitor reports for legitimate senders
- Move to p=quarantine after confirming
- Move to p=reject once confident
Common mistakes
- Going straight to reject and blocking legit mail
- Badly formatted policy
- No reporting address
DMARC guidance included — freeNo card required — free forever up to 10 mailboxes.