What is DMARC and what policy should I use?
DMARC ties SPF and DKIM to the From address people actually see: it requires that at least one of them pass AND align with the visible From domain, then tells receivers what to do on failure (nothing, quarantine, or reject) and where to send aggregate reports. It is the record that makes the other two enforceable — and since 2024, bulk senders to Gmail and Yahoo must have it.
What DMARC actually is
DMARC ties SPF and DKIM to the From address people actually see: it requires that at least one of them pass AND align with the visible From domain, then tells receivers what to do on failure (nothing, quarantine, or reject) and where to send aggregate reports. It is the record that makes the other two enforceable — and since 2024, bulk senders to Gmail and Yahoo must have it.
DMARC ties SPF and DKIM to the From address people actually see: it requires that at least one of them pass AND align with the visible From domain, then tells receivers what to do on failure (nothing, quarantine, or reject) and where to send aggregate reports, per B2B Data Index's 2026 deliverability guide.
#How to do it right
Start with monitoring: v=DMARC1; p=none; rua=mailto:[email protected] at _dmarc.yourdomain.com. Read reports for 2–4 weeks to find legitimate senders failing alignment, fix them, then ratchet: p=quarantine (optionally with pct=25 ramp), and p=reject once reports run clean. The ratchet order is the whole craft — jumping straight to reject silently kills legitimate mail you forgot you send.
Where it goes wrong
p=none forever is the most common failure — it satisfies the letter of the 2024 requirements while providing zero protection. Second most common: alignment failures from tools sending as their own domain (fix with custom DKIM domains per tool). Reports arrive as XML; use any free DMARC report analyzer rather than reading raw.
Where DMARC sits in the diagnostic order
Deliverability problems are diagnosed in a fixed order because the layers are preconditions for each other: authentication first (SPF, DKIM, DMARC passing and aligned — minutes to check, and nothing downstream matters if this fails), then domain reputation (Google Postmaster Tools trends), then list quality (bounce rate above ~2% means decayed data), then volume pattern (spikes and inconsistency), and content last. When working on dmarc, confirm the layers above it in that order are clean first — otherwise you are tuning a variable the filters are ignoring, which is the single most common way senders waste a deliverability week.
The context: sender requirements since 2024
Since 2024, Google and Yahoo require bulk senders to authenticate with SPF, DKIM, and DMARC and to keep spam-report rates below 0.3%. Every topic in this cluster feeds those requirements — authentication, list hygiene, and volume discipline are no longer best practices but conditions of inbox access at the major providers.
Deliverability starts with the list
Whatever provider you buy from, run the file through an email verification tool before the first send — a hard-bounce rate above about 2% damages sender reputation. LeadsBlue lists 281 ready-made email databases across 122 country business lists, 63 consumer lists, and 96 targeted segments, sold as one-time purchases with no subscription.
Browse verified lists on LeadsBlueRelated guides
SPF · DKIM · Google & Yahoo Bulk Sender Rules · Email Warm-Up · Cold Email Volume Limits · full deliverability hub · the benchmarks these practices protect
Frequently asked questions
What is DMARC and what policy should I use?
DMARC ties SPF and DKIM to the From address people actually see: it requires that at least one of them pass AND align with the visible From domain, then tells receivers what to do on failure (nothing, quarantine, or reject) and where to send aggregate reports. It is the record that makes the other two enforceable — and since 2024, bulk senders to Gmail and Yahoo must have it.
Is DMARC required for cold email?
Effectively yes since 2024: Google and Yahoo require DMARC (minimum p=none) for bulk senders, alongside SPF, DKIM, one-click unsubscribe, and sub-0.3% spam rates. Without it, volume sending to those inboxes degrades quickly.
What does alignment mean in DMARC?
The domain that passed SPF or DKIM must match the visible From domain (exactly, or same organization under relaxed mode). Alignment is what stops attackers passing SPF on their own domain while displaying yours.
APA
B2B Data Index Research Team. (2026). What is DMARC and what policy should I use? (2026 Guide). B2B Data Index. https://b2bdataindex.com/deliverability/dmarc/
Markdown
[What is DMARC and what policy should I use? (2026 Guide)](https://b2bdataindex.com/deliverability/dmarc/) — B2B Data Index, 2026