The alignment test
DMARC requires an SPF or DKIM pass that aligns with the author domain in the From header. Strict alignment requires identical domains; relaxed alignment uses the organisational-domain relationship. One aligned passing method can satisfy DMARC. The current core specification is RFC 9989. [IETF RFC 9989: DMARC]
Policy and visibility
A policy expresses the domain owner’s requested treatment of failures. Receiver decisions can still differ. DMARC does not cover lookalike domains or misleading display names; see BEC. [IETF RFC 9989: DMARC]
Aggregate reports describe observed sending sources, authentication outcomes and policy treatment. They are useful for identifying services to investigate, but are not a per-recipient inbox-placement receipt. RFC 9990 describes the current aggregate-reporting format. [IETF RFC 9990: DMARC aggregate reporting]
Our rollout method
- Identify legitimate sending services and owners before tightening policy.
- Review reports alongside message samples, especially forwards and third-party senders.
- Fix authentication and alignment, then test the actual business routes.
- Agree an enforcement change, success criteria and rollback with your change authority.
- Monitor afterwards and retain an exception register with owners and review dates.
We do not prescribe an immediate reject policy without knowing the sending estate. The output is a controlled implementation plan and evidence of the tested routes.
Primary sources
Provider requirements and product capabilities can change. Check the linked source before a production change.