DMARC

DMARC builds on SPF and DKIM. It requires the sending domain to align with them and tells receivers what to do with mail that fails. Put SPF and DKIM in place before you enforce DMARC.

Policy rollout

Policy	Effect
p=none	Monitor only. Nothing is blocked.
p=quarantine	Failing mail is treated as suspicious, usually sent to spam.
p=reject	Failing mail is refused.

Start at none, read the reports, fix legitimate senders, then step up.

Why p=none is a Warn

The record is published, but it does not protect anyone yet. SigHQ shows Warn rather than Pass until the policy enforces.

Why it matters for signatures

A strong DMARC policy is what stops a spoofed message, one that carries none of your legal disclaimers, from reaching an inbox in the first place.

Fix it

• Microsoft: set up DMARC
• Google: set up DMARC

Next: BIMI.