DMARC policy for email: Crawl Audit check 159

Short answer: DMARC tells receiving mail servers what to do with email that claims to be from you but fails SPF and DKIM: nothing, mark it suspicious, or reject it. It also sends you reports on who is sending as your domain. Check 159 passes only when the policy is quarantine or reject.

What Crawl Audit checks

• Pass: a DMARC record with p=quarantine or p=reject.
• Warning: a record with p=none, which monitors but doesn't protect.
• Fail: no record at _dmarc.yourdomain.com.

What the sources say

• DMARC became a full internet standard in May 2026 as RFC 9989, replacing RFC 7489. Under it, none means the owner "offers no expression of preference", and reject means failures are "a clear indication that the use of the domain name is not valid."
• RFC 9989 removed the pct tag, which older guides use to apply a policy to a percentage of mail. It added t=y for test mode.
• Google, for bulk senders: "Your DMARC enforcement policy can be set to none." That's the minimum to deliver, not the safe end point.
• Microsoft has rejected mail since 5 May 2025 from domains sending over 5,000 messages a day to Outlook.com without SPF, DKIM and DMARC. It advises "moving gradually (none → quarantine → reject)".
• UK NCSC: "Having a DMARC policy of ‘reject’ on all of your domains is the best way to prevent spoofing of your email."

Moving up safely

1. Start at p=none with a rua= address so reports come in.
2. Read the reports. Every service that sends as you (mailbox, newsletter, invoicing, booking tools) should pass SPF or DKIM.
3. Move to p=quarantine, then p=reject once nothing legitimate is failing.

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

On devmarde.com

Our record on 6 October was p=none, with reports going to our email platform, so this check warns for us. We're staying there while we confirm that every service that sends as us passes, and we'd rather show that than claim a stricter policy.

Sources

• IETF, RFC 9989: DMARC (May 2026).
• Google, Email sender guidelines, and Microsoft, Outlook's new requirements for high-volume senders (updated 30 April 2025).
• NCSC, Reject spoof emails, checked 6 October 2026.