Pink PostWhat DMARC does
DMARC (RFC 7489) sits on top of SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From address the reader sees. The DMARC record then tells receivers what to do with mail that fails: deliver it anyway (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It also asks receivers to send you reports about who is sending as your domain.
Every DMARC tag, explained
| Tag | Meaning | Example |
|---|---|---|
| v | Version. Must be DMARC1 and come first. | v=DMARC1 |
| p | Policy for the domain: none, quarantine or reject. Required. | p=quarantine |
| sp | Policy for subdomains. Defaults to p. | sp=reject |
| rua | Where aggregate (daily summary) reports go. | rua=mailto:[email protected] |
| ruf | Where failure reports go. Many providers do not send them. | ruf=mailto:[email protected] |
| pct | Share of failing mail the policy applies to. Default 100. | pct=50 |
| adkim | DKIM alignment: r (relaxed, default) or s (strict). | adkim=r |
| aspf | SPF alignment: r (relaxed, default) or s (strict). | aspf=r |
| fo | Failure reporting options. | fo=1 |
A safe rollout plan
- Publish
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Nothing changes for delivery, but reports start arriving. - Read the aggregate reports for two to four weeks. Find every service that sends as you and fix its SPF or DKIM.
- Move to
p=quarantine, optionally withpct=25, then raise pct to 100. - When reports show only legitimate, aligned mail, consider
p=reject.
Reports are XML files and can be large. A DMARC report reader or a dedicated inbox helps.
DMARC and cold outreach
Since 2024 Gmail and Yahoo require a DMARC record (at least p=none) for anyone sending around 5,000+ messages a day to them, plus an aligned SPF or DKIM pass. Outreach volumes are usually far lower, but the filters still reward authenticated mail. Set DMARC up on any domain you pitch from, then let Pink Post's sending caps and warm-up keep volume natural.