What does DMARC check first?
DMARC connects the domain in the visible From address to a successful SPF or DKIM result. At least one must pass and align under the configured rules. A technical pass for an unrelated domain does not provide that connection. Google's email sender guidance explains authentication and alignment as separate requirements.
Ask a reviewer to distinguish three statements: a policy exists, a message passed authentication, and the authenticated domain aligns with the business's visible identity. Those statements answer different questions. A report that collapses them into one green status can hide the part that needs attention.
Does a monitoring policy mean nothing is happening?
A p=none policy does not request quarantine or rejection on the basis of DMARC failure. It can still support reporting, and receiving providers can apply their own security decisions. Google recommends a staged rollout that begins with observation of the domain's legitimate mail.
Monitoring is useful when someone is actually reviewing the evidence. We recommend asking who receives reports, who interprets unfamiliar senders, and what must be resolved before the next policy decision. A monitoring stage with an owner and an exit condition is different from a forgotten record.
When should stronger enforcement be considered?
The decision should follow a verified sender inventory and representative tests. Quarantine and reject increase the requested treatment for failures; they do not repair a legitimate service that is incorrectly configured. If an important sender is still unexplained, the change plan should say how that issue will be investigated.
Our recommended approval note names the policy being changed, the business services tested, the person approving the change, and the response if legitimate messages fail. Avoid a blanket instruction to select the strictest value immediately. The right sequence depends on the sending setup, including third-party tools and forwarding paths.
What does an absent record establish?
It establishes a finding about the lookup that was performed. The report should identify the domain, the relevant name checked, the time, and any lookup errors or policy-discovery limits. It should not jump from an absent record to an assertion that an attacker accessed an account or stole money.
Likewise, seeing p=reject is not a universal safety certificate. Receiving systems make delivery decisions, and DMARC does not assess the truth of a message's business request. A compromised legitimate account or a different lookalike domain requires attention beyond this policy.
What decision should you leave with?
Leave with a next action supported by evidence: investigate a sender, correct a configuration, continue a defined observation period, or approve a staged policy change. The useful result is a reasoned decision and a written record, not a harsher label for its own sake.
- What does the current policy request?
- Which legitimate senders have been verified?
- What remains unknown, and who will resolve it?
- What evidence will support the next policy decision?