Under p=quarantine or p=reject, mail that fails DMARC is junked or refused. Your own mailboxes are usually fine. What breaks is everything else that sends as your domain: the CRM, invoicing, HR, ticketing, survey and marketing tools. Each one has to authenticate with your domain, not just be listed in SPF.
Enter your domain: the check reads SPF, DKIM keys at the selectors 35 vendors use, and your DMARC record, in your browser, and writes the request each vendor needs.
DMARC passes when SPF or DKIM passes and the domain it checked matches (aligns with) the domain in the From address. Most services send with their own bounce address, so SPF passes for their domain, not yours: listing them in SPF isn't enough. The fix that works almost everywhere is DKIM signed with your domain (d=yourdomain.com or a subdomain of it, under the default relaxed alignment).
v=DMARC1; p=none; rua=mailto:… and read the aggregate reports for a few weeks: they show every source that sends as you, including ones nobody told IT about.billing.yourdomain.com) with its own policy, or have them send from their own domain with yours as Reply-To.p=quarantine, watch the reports, then p=reject.selector1 and selector2 (CNAMEs; new domains since May 2025 point to …dkim.mail.microsoft).google by default (you can choose another prefix).s1 and s2 with automated security, m1 without.zendesk1 and zendesk2; publish the CNAMEs before enabling the setting, or mail fails.kl1/kl2; new domains km1/km2 (marketing), kt1/kt2 (transactional), ks1/ks2 (service).brevo1 and brevo2 (turn off CNAME flattening on Cloudflare). Fastmail: fm1–fm3.Every include:, a, mx, exists: and redirect= costs a DNS lookup, and includes nest. Over 10 and SPF returns a permanent error for all your mail. Two SPF records on the same name is also a permanent error. Once a vendor signs with DKIM, it often doesn't need to be in SPF at all.
pct, rf and ri are retired. Receivers that follow the new standard ignore pct, so p=quarantine; pct=25 acts as full quarantine there. For a test step use t=y, which asks receivers to apply one level less (reject → quarantine, quarantine → none).np (policy for subdomains that don't exist) and psd (for public-suffix operators; leave it out).Enter your domain: the check reads SPF, DKIM keys at the selectors 35 vendors use, and your DMARC record, in your browser, and writes the request each vendor needs.
Which vendor held up your move to reject, and what did they say when you asked?
We're researching this problem and read every answer. Tell us what happened (4 short questions, no sign-up; AI tools help us read the answers).