A message passes DMARC when SPF or DKIM passes and the domain it checked aligns with the domain in the visible From address. The record lives at _dmarc.yourdomain and sets a policy: p=none (only report), p=quarantine (send failures to spam) or p=reject (refuse them).
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"
A safe way to roll it out
- Start with p=none and a rua address, and read the aggregate reports for a few weeks to find every service that sends as you.
- Fix SPF and DKIM for each of them until the reports show your real mail passing.
- Move to p=quarantine, optionally with pct below 100 at first, then to p=reject when nothing legitimate fails.
DMARC and cold email
Gmail and Yahoo have required a DMARC record, at least p=none, from bulk senders since 2024, and a missing record is one of the most common reasons new domains struggle. A record at p=none costs nothing and protects you from people spoofing your brand once you tighten it. Enforcement (quarantine or reject) is also required before you can use BIMI.
Build the record with the DMARC record generator, which explains every tag, and check it with the domain email checker. In ZicReach, domain checks look for a DMARC record on each sending domain, flag duplicates and show the record to add when one is missing.