What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that acts as the final layer of defense against email spoofing and phishing. It tells receiving mail servers what to do when an email fails SPF or DKIM checks, whether to deliver it anyway, quarantine it, or reject it outright.
How DMARC Works
- You publish a DMARC policy in your DNS as a TXT record.
- When a receiving server gets an email from your domain, it checks SPF and DKIM first.
- If either check fails, the server looks at your DMARC policy to decide what to do.
- The server sends you aggregate reports showing who is sending email on behalf of your domain.
DMARC Policy Options
- p=none: Monitor mode, emails are delivered regardless, but you receive reports.
- p=quarantine: Failed emails go to spam/junk folders.
- p=reject: Failed emails are blocked entirely.
Why DMARC Matters for Cold Email
Without DMARC, spammers can freely impersonate your domain. This damages your sender reputation even if you're not sending those emails. For B2B outbound teams, a properly configured DMARC policy:
- Protects your domain from impersonation
- Improves deliverability by building trust with receiving servers
- Provides visibility into who is sending email using your domain
- Is increasingly required by major email providers (Google and Yahoo made DMARC mandatory in 2024)
Implementation Steps
- Start with
p=noneto collect data without affecting delivery. - Review aggregate reports for 2-4 weeks to identify legitimate senders.
- Ensure all legitimate senders pass SPF and DKIM.
- Gradually move to
p=quarantine, thenp=reject.
Common Mistakes
- Jumping straight to p=reject: This can block legitimate emails from third-party tools you forgot about.
- Ignoring reports: DMARC reports reveal critical insights about your email ecosystem.
- Not aligning SPF/DKIM: DMARC requires alignment between the envelope sender and the header "From" domain.