Do I really need DMARC?

Since 2024 Gmail and Yahoo require SPF, DKIM and a DMARC record from bulk senders. For small senders a DMARC record also lowers the risk that third parties forge your domain.

rua is the address to which receivers send daily summaries. They show which servers send mail with your domain and whether SPF and DKIM pass.

Why is sp=none a risk?

The policy of the main domain then does not apply to subdomains. Attackers use exactly such gaps for forgeries.

Check and set up DMARC: policy none, quarantine, reject and reports

DMARC tells a receiver what to do with mail that claims to come from your domain but fails SPF and DKIM. It also sends you reports on who sends in your name.

The DMARC record

DMARC lives in a TXT record at _dmarc.your-domain. A first entry for observing looks like this:

_dmarc.example.org.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.org"

The p= policy

p=none only observes and does not protect yet.
p=quarantine moves failing mail into the spam folder.
p=reject rejects it and gives the strongest protection against forgeries of your domain.

Alignment

DMARC passes when SPF or DKIM passes and the checked domain matches the visible From domain. With aspf and adkim you choose between relaxed (subdomains allowed) and strict (exact match).

Subdomains and pct

With sp= you set a separate policy for subdomains. If it says none, all subdomains are unprotected although the main domain is protected. With pct= you apply the policy to only a share of the mail. For full protection, do not leave pct below 100 permanently.

The safe path to p=reject

Start with p=none and a rua address and read the reports.
Add every legitimate sender to SPF and DKIM until the reports show no unknown sources.
Switch to p=quarantine, then to p=reject.

Check and set up DMARC