DMARC (Domain-based Message Authentication, Reporting & Conformance) is the rulebook that tells inbox providers what to do when an email fails authentication.

SPF and DKIM run the checks. DMARC enforces the decision.

Without DMARC, inbox providers are forced to guess. With DMARC, you give them clear instructions.

If someone tries to send an email pretending to be your domain and it fails SPF or DKIM, DMARC answers one question:

“Should I let this through, send it to spam, or block it completely?”

Without DMARC, fake emails can slip through. That damages trust, reputation, and eventually deliverability.

Every incoming email goes through this sequence:

DMARC does nothing on its own. It only acts when SPF or DKIM fails.

DMARC has three enforcement levels. Each one tells inbox providers how strict to be.

What it does Inbox providers deliver the email normally, even if it fails authentication.

Why it exists So you can test your setup and receive reports without blocking anything.

When to use it

This offers visibility, not protection.

What it does If an email fails authentication, it is sent to the Spam folder.

Why it exists It prevents fake emails from landing in the Primary Inbox while still allowing delivery.

When to use it

This is the most common setting for cold email domains.

What it does If an email fails authentication, it is blocked completely.

Why it exists To eliminate spoofing and impersonation entirely.

Risk If your own configuration is wrong, you will block your own emails.

This is maximum security, not a testing mode.

DMARC is added as a TXT record in your domain’s DNS.

_dmarc

v=DMARC1; p=none;

v=DMARC1; p=quarantine;

or, if you are confident:

v=DMARC1; p=reject;

Because these are secondary domains, there is no reason to stay unprotected.

Google and Yahoo have changed the rules.

If you send at scale and do not have DMARC, your emails will:

DMARC is no longer optional. It is now table stakes for cold email.