Email Deliverability and DMARC Policies

Initially these issues were isolated to domains that were registered some time ago and were missing a SPF record in their DNS. As new domain registrations have these records in place by default, we expected fewer cases as a result. This wasn't exactly the case. A few clients got in touch for help as their emails were silently getting lost in transit, like when you send cash in birthday cards via Royal Mail these days. 😉

DNS or the Domain Name System is used to map numerical IP addresses (used by computers) to the human-readable domain name and any connected services. This correctly directs web traffic to your website, routes emails to the right mail server and connects to other online resources. Thus allowing everything to work under a consistent domain name.

In October 2023 Google and Yahoo announced that, as a proactive step towards strengthening email security, SPF (Sender Policy Framework) implementation would be required with enforcement beginning in 2024 with requirements gradually becoming stricter throughout the year.

As of May 5, 2025 Microsoft followed suit, joining Gmail, Yahoo and Apple Mail in requiring DMARC. Now, as mail authentication trends show, and with all major hosted email providers requiring SPF and DKIM/DMARC for bulk senders, DMARC is no longer just a best practice.

Circa November 2025 Google ramped up enforcement for non-compliant traffic, warning messages that failed to meet sender requirements would be likely to be subject to temporary or permanent rejections. A number of enterprise mail-filtering platforms also set policies to do the same.

While the addition of DKIM and DMARC were only announced as a requirement for bulk senders (5,000 or more emails per day), the phased enforcement led to some clients experiencing the loss of sent emails. Only becoming aware of the issue when following up via phone. A couple already using third-party e-marketing software without the correct DNS configuration ended up on Google's blocklist, still having to wait weeks to be removed after we had assisted them make the necessary changes.

Therefore, we are recommending all customers with their own domain implement a DMARC policy.

While you may not be sending a large volume of emails, implementing DMARC is still a good idea. Your website may be sending emails, especially if you're running an e-commerce site or using a third-party hosted service for e-marketing, accounting, sales or support purposes. Some of these use shared sending domains or servers. You have no control over what other people are doing, implementing strong policies helps to improve your domain's reputation, limiting deliverability issues.

By publishing a DMARC DNS TXT record, you can also receive reports to identify and fix authentication issues.

So What is DMARC, Prey Tell?

DMARC or Domain-based Message Authentication, Reporting and Conformance is an email authentication protocol that allows domain owners to use SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify the authenticity of emails sent from their domain.

DMARC policies advise how receiving mail servers should handle emails that fail SPF or DKIM authentication, acting as a security measure and helping to improve deliverability by increasing trust in your domain.

DMARC works by cross-referencing three components: SPF, DKIM and the "From" email header via the DNS of a domain. Reports may refer to mail authentication failures as SPF or DKIM not being aligned.

DMARC helps prevent cybercriminals and other pesky digital-pirati from impersonating your domain (spoofing) in phishing attacks, usually aimed at capturing personal/business data, committing financial fraud or installing malicious software.

Metaphorically speaking, DMARC is the final leg of a tripod. SPF defines allowed sending sources, DKIM signs the message and DMARC advises receiving mail servers on what action to take for messages that fail SPF or DKIM checks.

DMARC is intended to make the inbox a safer place by stopping malicious emails from being delivered and catching emails with forged information in the 'From' header.

DMARC helps to ensure your important communications are more likely to make it to your customers' inbox.

Many mail clients, especially on mobile devices, have compacted UIs that show the sender's name not the actual email address. This can make it harder to spot spoofed emails. DMARC helps to address this by providing a mechanism for verifying the authenticity of emails.

As email is a popular way for businesses to interact with people. DMARC ensures customers and prospects don't have to worry when opening emails from your brand.

Key points at a glance:

• Spoofing Protection: DMARC prevents malicious parties from sending fraudulent emails impersonating your domain.
• Improved Inbox Placement: By proving your legitimacy, DMARC helps your emails reach the primary inbox (not spam).
• Brand Reputation: Customers trust your brand when you have not been impersonated in malicious emails.
• Standards Compliance: Many industries require DMARC for email security compliance and some enterprise mail filters will swallow messages without it.
• Actionable Insights: Reports provide data to identify and resolve any authentication issues affecting your email campaigns.

Implementing DMARC helps ensure that legitimate emails from your domain reach your recipients' inboxes while reducing the risk of phishing and spoofing. By validating your emails through SPF and DKIM, DMARC provides mailbox providers with confidence that your messages are authentic.

Beyond security, DMARC also supports your domain’s reputation. Consistently authenticated emails signal to Internet Service Providers (ISPs) that your communications are trustworthy, which can improve inbox placement over time.

Key points at a glance:

• Authentication: DMARC validates the sender's identity against your SPF and DKIM records.
• Policy Enforcement: It instructs mailbox providers on how to handle unauthenticated emails, preventing spoofed messages from impacting your brand.
• Domain Reputation: By actively managing and reporting on your domain's email authentication, DMARC signals to Internet Service Providers (ISPs) that your emails are genuine and trustworthy, improving your reputation and increasing the likelihood of reaching the inbox.

DMARC has three distinct policies you can apply, each offering a different balance of monitoring and protection.

p=none (Monitor)

The none policy allows you to monitor email traffic without affecting delivery of messages that fail DMARC checks. It's the recommended starting point as it provides reports on email authentication results, helping you to identify issues and understand your email environment. The risk is that malicious emails spoofing your brands domain could still make it to someone's inbox

If your website sends emails, make sure your server is included in your SPF and DKIM records.

If you use services like Gmail or Office 365, check you have included these in your SPF record.

If you have a dedicated domain, subdomain dedicated to sending transactional emails or receipts, using the ‘none’ policy for 3-6 months is advised.

p=quarantine (Quarantine)

The quarantine policy instructs receiving mail servers to treat messages that fail DMARC checks as suspicious. Emails that fail authentication are usually still delivered but will go to the recipient's spam or junk folder. This policy should be applied once SPF and DKIM have been implemented and tested. This policy allows you to gather data and catch any remaining issues without sending any legitimate emails to spam.

p=reject (Reject)

The reject policy instructs receiving mail servers to reject emails that fail DMARC checks. It provides the strongest protection against email spoofing but requires cautious implementation and monitoring to avoid blocking legitimate emails.

When to Use Reject or Quarantine?

For most, the end goal for a DMARC policy is reject, as it provides the best level of protection against email spoofing and phishing attempts.

The word on the grapevine also suggests that in the coming years a reject policy will be the requirement, so it makes sense to plan ahead.

That said, going directly to a reject policy can be risky if not done carefully, so a phased approach is always recommended.

Starting with a none policy is a good first step to gather data and verify legitimate sending sources. This allows you to identify and resolve any issues before moving to a quarantine policy, finally setting a reject policy once you are confident in the setup.

DMARC Best Practice Final Recap

• Configure SPF and DKIM First: Ensure both SPF and DKIM records are correctly set up for your domain.
• Validate Setup: Ensure your SPF and DKIM configurations are correct before implementing a DMARC policy.
• Publish a DMARC Record: Add a DMARC DNS TXT record.
• Start with p=none: Begin with a minimal policy to analyse reports and identify issues.
• Monitoring: Regularly check DMARC reports to identify and address any issues with legitimate email sources.
• Identify All Sources: If emails are sent from third-party CRM systems or marketing platforms, stick to the p=none policy for an extended time.
• Phased Rollout: Transition from p=none to p=quarantine to minimise the risk of disrupting legitimate email delivery.
• Monitor Reports: Regularly review the aggregate and forensic reports to understand email flow and identify potential threats.
• Gradually Increase Policy: As you fix authentication problems, you can gradually move to p=reject to enforce stricter controls.
• Don’t Send Spam: Yahoo requires you only send messages to recipients who have opted in. You honor the stated frequency established at the point of registration, and you don’t buy lists. Gmail requires you to keep your Spam Complaint Rate below 0.3%.
• Don't Forget to Breathe: DMARC is a recommendation, how it's enforced can vary. Some email providers may not behave as expected, Hotmail can show false results in reports. Even with a reject policy, emails might still be delivered. Spam filters may block emails that contain spammy words, reject emails if your domain is blacklisted or has a poor reputation.

DMARC adoption is a recommendation for all senders to protect against the prolific amount of phishing and spoofing in the AI era. DMARC is now a required by major providers for bulk email senders.

While implementing a DMARC record is not for all, it's important to protecting your domain's brand reputation and other users. Especially the more gullible ones that like to click funky looking links.

Handy Tools and Resources

• Dmarcian: A comprehensive resource for understanding and implementing DMARC, including tools for domain checking, DMARC inspecting and generating DMARC records and analyzing reports.
• DMARC.org Tools: A collection of tools for generating DMARC records and analyzing DMARC reports.
• MXToolbox DMARC Lookup: A tool to check your DMARC record and validate its configuration.
• Mail Tester: A tool to test your email's deliverability and check for common issues that may affect inbox placement.

Google Workspace

• Google Workspace users should refer to the Gmail help docs on how to prevent spoofing, phishing and spam.
• Google Workspace Admins can use the Google Admin Toolbox to troubleshoot issues you have with Google Workspace services.
• Gmail also provides Postmaster Tools, a reputation checking service to help you keep track of your spam rates.

Microsoft 365

• Office 365 users can refer to the Microsoft Defender help docs on Email authentication in cloud organizations.

If you need assistance meeting the requirements, we can help. Get in touch with us to discuss your options and how we can support you in implementing DMARC for your domain.