Deliverability

DMARC

DMARC ties SPF and DKIM together: it tells receiving servers what to do when a message claiming to be from your domain fails those checks, and asks them to report back on what they saw.

Without it, SPF and DKIM produce signals nobody is obliged to act on. DMARC turns them into a policy — do nothing, quarantine, or reject — and gives you the reports showing which servers are sending as your domain, including the ones you did not know about.

Start at p=none, which changes nothing about delivery but turns reporting on. Read the reports for a few weeks, confirm every legitimate sender passes, and only then tighten to quarantine and reject. Jumping straight to reject on an unaudited sending stack is how a company discovers its invoicing system was never authenticated.

Goes deeper: Why Your Cold Emails Land in Spam