What does DMARC check first?
DMARC connects the domain in the visible From address to a successful SPF or DKIM result. At least one must pass and align under the configured rules. A technical pass for an unrelated domain does not provide that connection. Google's email sender guidance explains authentication and alignment as separate requirements. Source
Ask separately whether a policy exists, a message passed authentication and the authenticated domain aligns with the visible identity. One green status can hide these differences.
Does a monitoring policy mean nothing is happening?
A p=none policy does not request quarantine or rejection on the basis of DMARC failure. It can still support reporting, and receiving providers can apply their own security decisions. Google recommends a staged rollout that begins with observation of the domain's legitimate mail. Source
Ask who receives reports, interprets unfamiliar senders and resolves issues before the next policy decision. Monitoring needs an owner and an exit condition, not just a published record.
When should stronger enforcement be considered?
The decision should follow a verified sender inventory and representative tests. Quarantine and reject increase the requested treatment for failures; they do not repair a legitimate service that is incorrectly configured. If an important sender is still unexplained, the change plan should say how that issue will be investigated.
Our recommended approval note names the policy being changed, the business services tested, the person approving the change, and the response if legitimate messages fail. Avoid a blanket instruction to select the strictest value immediately. The right sequence depends on the sending setup, including third-party tools and forwarding paths.
What does an absent record establish?
It establishes a finding about the lookup that was performed. The report should identify the domain, the relevant name checked, the time, and any lookup errors or policy-discovery limits. It should not jump from an absent record to an assertion that an attacker accessed an account or stole money.
Likewise, seeing p=reject is not a universal safety certificate. Receiving systems make delivery decisions, and DMARC does not assess the truth of a message's business request. A compromised legitimate account or a different lookalike domain requires attention beyond this policy.
What decision should you leave with?
Choose an evidence-supported action: investigate a sender, correct a configuration, continue defined observation or approve a staged change. Record the reason—not just a harsher label.
- What does the current policy request?
- Which legitimate senders have been verified?
- What remains unknown, and who will resolve it?
- What evidence will support the next policy decision?