ON THIS PAGE
By Efe Berke Colaker, Founder at GetleadReviewed by the Getlead editorial team for accuracy. Last updated August 2026.
DMARC is the record everyone publishes once, sets to p=none, and never touches again. That satisfies the letter of the bulk sender requirements and delivers almost none of the benefit. Because p=none instructs receivers to do nothing at all.
This is what the three policies actually do, how to read the reports that justify moving between them. And the rollout order that avoids the classic mistake of blocking your own mail on a Friday afternoon. It assumes you have already met the bulk sender requirements.
What DMARC checks that SPF and DKIM do not
SPF says which servers may send for a domain. DKIM signs the message so tampering is detectable. Neither connects those checks to the address a human actually sees in the From line, and that gap is exactly where impersonation lives.
DMARC closes it by requiring alignment: the domain that passed SPF or DKIM has to match the domain in the visible From header. A message can pass SPF for a bulk sending platform, show your brand in the From line, and fail DMARC, which is the correct outcome.
Alignment also has a strictness setting. Relaxed alignment, which is the default, accepts a subdomain of your organizational domain. Strict alignment requires an exact match. Relaxed is right for almost everyone, because subdomains are how sending platforms are normally integrated.
DMARC is a published policy that tells receiving servers what to do when a message claiming to be from your domain fails authentication. And whether to report the failure back to you.
For example, a company with six sending systems typically finds two of them unaligned during the first month at p=none. That is exactly the discovery that makes moving to quarantine safe rather than disruptive.
The three policies and what each instructs receivers to do
The percentage tag is the safety valve people forget. Setting pct=25 applies the policy to a quarter of failing messages. That lets you watch the effect on a slice of traffic before committing everything. Ramping the percentage is safer than jumping the policy.
A working record
A monitoring record is short: the version tag, the policy, and a reporting address such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The rua address is what makes the phase useful. And leaving it out is the single most common way teams waste the monitoring period entirely.
Point the reporting address at a mailbox or a parser you will actually look at. Aggregate reports arrive as compressed XML daily from every major receiver, which is unreadable by hand at any real volume.
Reading aggregate reports without drowning
Every report answers one question repeatedly: for each source that sent mail claiming to be you, did SPF and DKIM pass, and did they align. You are looking for three categories in the results.
- Your known senders, aligned. Your mail platform, your helpdesk, your invoicing system. Nothing to do.
- Your known senders, failing alignment. A real service you forgot to configure. Fix the configuration, do not exclude the source.
- Unknown sources. Either a forgotten integration or someone impersonating your domain. This is the category DMARC exists to reveal.
The second category is what keeps most teams at p=none for years. Marketing platforms, e-signature tools, recruiting systems and CRM notifications all send on your behalf. And each needs its own alignment work before enforcement is safe.
For example, four weeks of monitoring is usually enough to surface the monthly senders as well as the daily ones. Invoicing and payroll systems in particular only appear once a cycle. And moving to enforcement before you have seen a full month is how they get blocked.
Forensic reports are usually not worth it
DMARC also defines failure reports, sent per message rather than aggregated. In practice most large receivers do not send them, privacy rules limit what they can contain. And the volume is unmanageable on a domain with any real traffic. Aggregate reports answer the questions that matter.
If you do want per message detail, sample it during the monitoring phase on a low volume domain and turn it off before enforcement. It is a debugging tool, not a monitoring one.
The rollout, week by week
Slow is fast here. The whole sequence takes about two months and each step is reversible in the time it takes DNS to propagate.
- Weeks 1 to 4: publish p=none with a reporting address. Collect reports and inventory every legitimate sender.
- Week 5: fix alignment for every known sender that is failing. Do not proceed while any real service is unaligned.
- Week 6: move to p=quarantine with pct=25 and watch for complaints from internal teams.
- Week 7: raise to pct=100 on quarantine. Anything still failing is now going to spam, so this is the real test.
- Week 8: move to p=reject. Failing mail is refused rather than filed, which is the outcome you want for impersonation.
- Ongoing: keep the reporting address alive. New tools get added to companies constantly and each one needs alignment.
The final step matters more than it looks. A DMARC record set to reject and then forgotten becomes a trap for the next person who integrates a new sending tool. So the reporting habit is the part that has to survive the project.
What to do when something breaks
Roll back the policy first and investigate afterwards. Changing p=reject to p=none is a DNS edit that takes effect within minutes, and it restores delivery while you find the misaligned sender. Debugging under a live reject policy means every hour of investigation is an hour of blocked mail.
Then find the source in the aggregate reports, fix its alignment, and step forward again. The staged rollout exists precisely so that a mistake costs one step rather than the whole project.
What this means for cold email specifically
Cold outbound runs from separate sending domains, which changes the calculus in two useful ways.
- The sending domain is new and has few integrations, so the inventory phase is short and reaching enforcement is quick.
- Your primary domain, with all its legacy senders, can move slowly without holding up outbound.
- Enforcement on the sending domain protects the brand you are actively putting in front of strangers.
- A reject policy on a domain nobody else sends from carries almost no risk of blocking legitimate mail.
In practice a fresh cold email domain can go from p=none to p=reject inside two weeks, because there is nothing to break. Use the same monitoring discipline anyway, since the reports also reveal misconfiguration in your own sending setup.
None of this affects placement on its own. DMARC prevents others from sending as you and satisfies a requirement receivers now enforce. But the inbox still depends on list quality and complaint rate, where the ceiling is 0.3% of delivered messages.
Sources and method
First-party data (Getlead, 2026): the verification split of 43.4% confirmed valid, 23.9% invalid, 16.7% catch-all and 16.0% unknown comes from 383,368 addresses analyzed through live SMTP verification. And the 0.51% bounce rate comes from 34,973 tracked sends, aggregated and anonymized at campaign level. Full method in our cold email benchmark study.
External sources: DMARC itself is specified in RFC 7489. That defines the policy tags, alignment modes and aggregate reporting described here; the requirement for a published DMARC record and the 0.3% spam complaint ceiling come from the Google Workspace sender guidelines, 2026.
Figures were checked in August 2026.
Frequently asked questions
What does DMARC actually do?
It tells receiving servers what to do when a message claiming to be from your domain fails authentication. And it requires alignment between the domain that authenticated and the domain shown in the From header. SPF and DKIM alone never make that connection, which is the gap DMARC closes.
What is the difference between p=none, p=quarantine and p=reject?
p=none instructs receivers to take no action and only send reports. p=quarantine sends failing mail to the spam folder. p=reject refuses it outright. Bulk sender requirements are satisfied by p=none, but protection against impersonation only begins at quarantine.
How long should I stay at p=none?
About four weeks, which is long enough to see monthly senders such as invoicing and payroll alongside daily ones. Moving to enforcement before a full billing cycle has passed is the most common way teams block their own legitimate mail.
Do I need DMARC for cold email?
Yes. Google, Yahoo and Microsoft all require a published DMARC record for domains sending at volume, with p=none as the minimum. A dedicated cold email domain has few integrations, so it can usually reach p=reject within two weeks.
What is the pct tag in a DMARC record?
It applies the policy to a percentage of failing messages rather than all of them. Setting pct=25 with quarantine lets you observe the effect on a quarter of failing traffic before committing. That makes the move to enforcement reversible in practice.
Will DMARC improve my inbox placement?
Not directly. It prevents others from sending as your domain and satisfies a requirement receivers enforce. But placement still depends on list quality, sending behaviour and complaint rate, where the ceiling is 0.3% of delivered messages.