What is DMARC, and when should your shop move past p=none?
The instruction you publish for every inbox: what to do with mail that claims to be from your shop and can't prove it. Plus regular reports on everyone sending as you.
- 027DMARC (Domain-based Message Authentication, Reporting and Conformance)
- An email authentication protocol that helps protect domains from email spoofing and phishing attacks. DMARC ensures that your emails are properly authenticated, helping to maintain a trustworthy sender reputation and protect your domain.
- Lives in
- A TXT record at _dmarc on your domain
- Policies
- None, quarantine or reject
- Required by
- Google, for bulk senders, though a policy of none satisfies it
- Protects against
- Fake emails sent in your shop's name
Three DMARC policies, and what each does to failing mail
DMARC asks one question of every email that puts your domain in the from line. Did it pass SPF or DKIM on a domain that matches? If not, your policy tells the receiver what to do, and DMARC.org's overview sets out the options.
| Policy | What it asks of the receiver | When to use it |
|---|---|---|
| p=none | Nothing, except reports to you | The first weeks, while you find every sender |
| p=quarantine | Treat failing mail as suspicious, usually the spam folder | Once the reports show only senders you know |
| p=reject | Refuse failing mail outright | When nothing legitimate has failed for weeks |
Receivers treat your policy as a strong request and still make their own call. Reject is about as clear as you can be.
Why p=none is a start, not a finish
Let's face it, plenty of shops publish p=none to tick Google's box, then never look again. It does tick the box. Google's sender guidelines accept a policy of none from bulk senders.
It just doesn't protect anyone. None asks the receiver to do nothing, so a fake order email sent in your name still lands. Protection starts at quarantine, and the way there runs through the reports.
Reading DMARC reports before you tighten anything
Big receivers send reports to the address in your record, listing the servers that sent mail as your domain and whether each passed. They're machine files. Nobody reads them raw, so point them at a reporting tool that turns them into a list of senders.
- Publish p=none with a reporting address, so the reports flow
- Read a few weeks of reports and list every sender that's really you
- Authenticate each one, from Klaviyo and Shopify to the helpdesk and staff mail
- Move to quarantine and watch for anything legitimate failing
- Move to reject once the reports are boring
The slow part is never DNS. It's finding the forgotten tool that still sends invoices as you. Our DMARC set-up for Klaviyo goes through it record by record.
Related terms
FAQs
What happens to my emails if they fail DMARC?
It depends on your policy and on the receiver. At none, nothing is asked and you get a report. At quarantine, failing mail usually goes to spam. At reject, it's refused. That's why every legitimate sender gets fixed before you tighten, because reject applies to your own forgotten tools too.
Do we need DMARC if Klaviyo already authenticates our email?
Yes, if you send in volume to Gmail, because Google asks bulk senders for it on top of SPF and DKIM. It's also the only one of the three that protects your customers, by telling receivers what to do with mail pretending to be you. Klaviyo's authentication covers Klaviyo. DMARC covers everything in your name.
Who should look after our DMARC reports?
Somebody who'll read the summary every week or two and can get DNS changed when a new sender turns up. In plenty of shops that's whoever runs email, with the developer holding the DNS login. What matters is that the reports land somewhere real, not in an inbox nobody opens.
Rather we explained it on your own account?
Bring your Klaviyo account to a growth consultation. We'll walk through what this means for your numbers, in plain English, and what we'd fix first.
Half an hour with Theo, our founder.
We're all about relationships built on trust, mutual respect and a shared vision for success. If that sounds like your vibe, let's make some waves together 🌊
