Skip to the documentation
Knowledge base

DMARC policy

A starter p=none record, printed to copy or written by a sync, never tightened for you.

Details

  • Generated per domain as _dmarc.<domain> (v=DMARC1; p=none; rua=mailto:postmaster@<domain>) and copyable from the DMARC tab of Settings → Domains, behind the “DNS record” toggle.
  • A sync publishes the starter policy at p=none and replaces any policy already at _dmarc, so copy a tuned one somewhere first. p=none asks receivers to treat your mail exactly as they would have and to report what they saw. Stepping it up to quarantine or reject is yours alone, which is why it sits on its own DMARC tab rather than in the delivery checklist: DMARC is a policy about mail you send, and choosing p=reject for someone could quarantine their invoicing tool, their CRM and their newsletter overnight.
  • The DMARC tool at /tools/dmarc builds the record after that one. It reads what the domain publishes today and opens a step on from it (quarantine after none, reject after quarantine) and warns on five things as you build: no rua address, a jump from no record straight to p=reject, a pct below 100 on quarantine or reject, any ruf at all, and strict adkim or aspf. Once the tab has read anything at _dmarc it links straight to the tool with the domain filled in. A broken record counts, because the fix for one is a replacement rather than a second record alongside.
  • Reading the aggregate reports rua collects is the part that is not here. They arrive once a day as compressed XML, from every receiver that saw mail claiming to be from you, and nothing in OpenEmail unpacks them.