DMARC is an email authentication record that tells a receiving mail server what to do when a message fails SPF or DKIM checks: monitor it, quarantine it as spam, or reject it outright.
DMARC sits on top of two other authentication records, SPF and DKIM, and tells a receiving server what to do when a message fails one of those checks. SPF lists which servers are allowed to send for a domain. DKIM cryptographically signs each message so the receiver can confirm it wasn't altered in transit. DMARC ties the two together with a policy: monitor, quarantine, or reject.
Publish DMARC at p=none first. That's the monitoring setting: it asks receivers to report on a domain's mail without punishing anything yet. Watch those aggregate reports for a stretch, roughly a month, confirming legitimate mail authenticates cleanly and nothing surprising fails. Only then move to p=quarantine, which routes failing mail to spam instead of rejecting it, and watch again. When that's clean, move to p=reject.
Tightening the policy before reading the reports is how teams accidentally send their own legitimate mail to spam and spend a week wondering why replies dried up. The progression is a decision earned with data, in that order, not a checkbox to clear on day one.
Since February 1, 2024, Google requires a published DMARC record from any sender crossing 5,000 messages a day to Gmail addresses, alongside SPF and DKIM. Yahoo's bulk-sender guidance asks for at least a p=none record as the floor for anyone sending meaningful volume to Yahoo addresses. Most cold-sending subdomains never need to go past p=quarantine, since there's rarely legitimate mail flow on that subdomain worth protecting from spoofing the way there is on a corporate domain.
A cold-sending subdomain gets its own DMARC record, separate from the corporate domain, so a bad week in outbound never touches the mail that actually has to land. Most of these subdomains sit at p=quarantine indefinitely rather than progressing all the way to p=reject, since there's no legitimate mail on them worth protecting from spoofing.
People set the policy wrong on day one, jumping straight to p=reject before they've watched a single report. That's how a team ends up rejecting its own legitimate mail and can't figure out why replies stopped. DMARC also gets treated as optional for cold email specifically. It isn't. A brand-new sending domain has no engagement history to lean on, which makes authentication matter more for cold outbound than for an opted-in marketing list, not less.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us