DMARC: from p=none to p=reject

DMARC ties SPF and DKIM to the From address your recipients see and tells receivers what to do when neither passes with alignment. It also sends you reports about every source using your domain.

The record

_dmarc.example.co.uk  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk; adkim=r; aspf=r"

• p= policy: none (monitor), quarantine (spam folder) or reject.
• rua= where aggregate reports go. If the address is on another domain, that domain must publish an authorisation record or receivers will not send.
• pct= applies the policy to a percentage of mail, for ramping.
• sp= policy for subdomains; avoid sp=none once you enforce.
• adkim / aspf: relaxed (subdomains align) or strict.

The path

1. Publish p=none with rua. Nothing changes for your mail; reports start within a day.
2. Read the reports for two to four weeks. Each source is either yours (fix its SPF include or DKIM signing so it aligns) or not yours (that is the spoofing you are about to stop).
3. Move to p=quarantine, pct=25, then 50, then 100 over a few weeks, watching for complaints.
4. Move to p=reject. Forged mail is now refused at the door.

Why bulk senders must

Since 2024 Google and Yahoo require a DMARC record from anyone sending them significant volume, and Microsoft has followed. Without one, mail is throttled or junked regardless of content.

What whois.me.uk checks

Record presence and validity, policy strength, pct, subdomain policy, rua authorisation, and the combined spoofability verdict that puts SPF, DKIM and DMARC together.