DMARC

A message can pass SPF and DKIM while displaying a completely different From domain — that is exactly how a great deal of impersonation works. DMARC closes the gap by requiring that a passing check be for the same domain the reader sees.

So the question DMARC answers is not is this message authenticated but is this message authenticated as who it claims to be. That is the question a recipient cares about.

p=none asks receivers to do nothing differently and just send reports. It is a monitoring mode, and it is where every domain should start. p=quarantine asks for unaligned mail to be treated as suspicious. p=reject asks for it to be refused outright.

The mistake is publishing p=reject early, before the reports have shown you every legitimate service sending as your domain. The other mistake is leaving p=none forever, which provides no protection and — increasingly — no credibility with receivers.

Aggregate reports arrive as XML from every major receiver, daily. They list, per sending source, how much mail was seen and whether it aligned. The pattern to look for is a legitimate service failing alignment — that is the thing to fix before tightening policy.

Move through the policies deliberately: monitor until the report is clean, quarantine a percentage, then raise it. A domain that reaches enforcement without breaking its own mail has done the work in the right order.

SalesShift reports DMARC alongside SPF and DKIM for each sending domain you use, with a timestamp on every answer. When the checks cannot be performed and nothing is cached, it says so rather than returning a guess.