Question 1

What does DMARC add on top of SPF and DKIM?

Accepted Answer

Two things neither provides alone. It requires that a passing SPF or DKIM check also aligns with the domain a recipient actually sees in the From field, which is what closes the gap where mail passes SPF for one domain while displaying another. And it tells receivers what to do when nothing aligns, rather than leaving each of them to guess.

Question 2

Is p=none pointless?

Accepted Answer

Not at first. It turns on aggregate reporting, which is the only way to discover every system legitimately sending as your domain before you start rejecting things. It becomes pointless when a domain sits there for years treating monitoring as the finish line, because it provides no protection whatsoever.

Question 3

What is alignment, in plain terms?

Accepted Answer

Relaxed alignment accepts a match on the organisational domain, so mail.example.com aligns with example.com. Strict alignment demands the domain match exactly. Relaxed is the default and is right for most senders; strict breaks as soon as a subdomain or a sending platform is involved.

Question 4

Why does the record say pct and should I use it?

Accepted Answer

It applies the policy to a random percentage of failing mail, so you can roll enforcement out gradually rather than all at once. Use it briefly during a transition. Leaving it below 100 permanently means a determined sender only has to try repeatedly to slip through.

Question 5

Where should aggregate reports go?

Accepted Answer

A mailbox or service that can parse them, because raw reports are gzipped XML and unreadable at volume. If the address is on a different domain from the one being reported on, that domain has to publish its own record authorising the reports, otherwise they silently stop.

Question 6

Can DMARC break my legitimate mail?

Accepted Answer

Yes, if you enforce before checking. Anything sending as your domain that you forgot about — a CRM, an invoicing tool, an old server — starts failing the moment you move to quarantine or reject. That is exactly what the monitoring period and aggregate reports are for.

DMARC
Checker

Three Settings,
One That Protects

Watching, not acting

Treated as suspicious

Refused at the door

Four Ways a Record
Looks Fine and Is Not

pct below 100

No rua address

sp=none under a strict p

Two DMARC records

Monitoring Is a Phase,
Not a Destination

Publish p=none with a rua address

Fix every legitimate sender

Move to quarantine, then reject

DMARC Policies,
Answered

DMARCChecker

Three Settings,One That Protects