DMARC Reporting and Control

When you set p=none (monitor mode), you’re asking for DMARC reports. These are XML reports ISPs send you (usually daily) telling you which emails claiming to be from your domain passed or failed SPF/DKIM, and often why. It’s a treasure trove of info: you’ll see who is sending email as you (could be your legit services or a hacker in Timbuktu), and whether those messages authenticated properly. This reporting is important for larger organizations to understand their email ecosystem and spot abuse.

Once you’re comfortable that legitimate mail is authenticating and you’re not seeing unexpected sources, you can tighten the screws – move to p=quarantine and eventually p=reject. Gmail and Microsoft have been nudging senders in this direction; by 2024 Gmail essentially expected domain owners to have at least a monitoring DMARC in place. And if you’re sending high volumes, having a strict DMARC policy is now a best practice (and sometimes even a requirement by partners/clients).