DMARC asks whether at least one passing SPF or DKIM identity aligns with the domain visible in the From header. The DNS record also publishes a policy such as none, quarantine, or reject and can request aggregate reports through rua. A policy record can parse correctly while the underlying mail streams still fail alignment.
Starting at p=none lets a domain collect aggregate data without asking receivers to quarantine or reject failing mail. Those reports show which systems claim to send for the domain and which authentication paths align. Moving directly to reject before inventorying legitimate systems can block invoices, support mail, marketing mail, or a third-party application the owner forgot.
What the record changes
A reviewed fix block confirms all active senders, makes SPF or DKIM align for each, checks that the aggregate-report mailbox can receive reports, and then states a staged policy. Percent tags and subdomain policy need deliberate treatment. The final check reads the published record after propagation and tests real messages from every important stream.
- RFC 7489 defines DMARC's identifier-alignment and policy framework.
- A DMARC pass requires an aligned SPF pass or an aligned DKIM pass; the two mechanisms do not both have to carry every message.
- The required scope statement remains authentication-ready, not inboxing, because DMARC says nothing about list quality or sender reputation.
How to use this answer
An authentication check reads the domain's published SPF, DKIM, DMARC, MX, TLS reporting, MTA-STS, and related records, then validates syntax and relationships. The fix block contains proposed records for the customer's actual provider and order of operations. A domain can pass these checks and still reach spam, because reputation, volume, content, consent, and list quality live outside DNS.
- Check the visible From domain, sending service, return path, and DKIM signing domain before changing any record.
- Read the existing DNS, count SPF evaluation terms, find DKIM selectors, and evaluate DMARC alignment and reporting addresses.
- Apply one reviewed change at a time, wait for DNS propagation, and validate the published result before tightening policy.
Where the service stops
Reality Contact, LLC reads public DNS and public blocklist responses. We never log into your DNS, mail server, or sending platform, and we never send from your domain. You paste the proposed records. The scope is authentication-ready, not inboxing. List quality, content, volume, and sender reputation are outside what DNS can show. This is not legal advice, and mail-law compliance remains yours.
Sources: RFC 7489: DMARC; Google email sender guidelines; DMARC overview.