Whether you're protecting a single domain or managing hundreds for clients, you need reliable visibility into who is sending email on your behalf, and whether it's passing authentication.
DMARC itself is free. It's a DNS record and an open standard, and the aggregate reports are free too; receiving mail servers send them automatically. What costs money is making sense of those reports at scale, consistently, over time.
The question isn't whether you can afford DMARC monitoring. It's whether you can afford to enforce a policy without it.
Moving from p=none to p=reject without monitoring is how legitimate mail gets blocked. You need to understand every sending source before you tighten policy, and you need to keep watching after you do.
p=none
p=quarantine
p=reject
Each step requires monitoring to make safely. OnlyDMARC alerts you to unknown senders before they get blocked.
One line of DNS, zero risk to existing delivery:
v=DMARC1; p=none; rua=mailto:reports@yourdomain.comThat rua= address is where your aggregate reports go. Without monitoring, those reports are just XML sitting on a server nobody reads.
Mailbox-provider policies, industry standards, and public-sector mandates do not all impose the same rule. The details below distinguish delivery requirements, example controls, and explicit government mandates.
Explore a brief history of DMARC chronologyp=none or stronger. The visible From domain must align through SPF or DKIM.Once Google classifies a domain as a bulk sender, that classification is permanent. Google ramped up enforcement against non-compliant traffic from November 2025, including temporary and permanent rejection.
p=none or stronger.Yahoo does not publish a numeric bulk-sender threshold. Enforcement began in February 2024 and can include spam placement or rejection; one-click unsubscribe enforcement for promotional mail followed in June 2024.
p=none or stronger, aligned through SPF or DKIM.Microsoft initially routes non-compliant high-volume mail to Junk and says outright rejection will follow on a separately announced schedule. Microsoft 365 business addresses are not in scope.
Apple does not publish a numeric bulk-sender threshold or require a stated policy stronger than p=none. Its postmaster guidance says bulk mail will be rejected when all listed requirements are not met.
DMARC is an example control, not the single prescribed way to satisfy Requirement 5.4.1. Applicability and assessment depend on an organisation's PCI DSS scope and environment.
p=reject on every authority-owned main domain and subdomain.The same requirement calls for SPF on all main domains and subdomains, plus DKIM on main domains and the subdomains used in mail flow.
p=reject.The directive is explicit but narrow: it does not apply to every US government body or automatically extend to government contractors.
The guidance also requires inbound DMARC enforcement and regular review of DMARC reports. It does not impose one universal DMARC policy level across every public-sector domain.
Mailbox-provider rules differ. Depending on the provider and failed requirement, non-compliant bulk mail can face temporary rejection, spam placement, or permanent SMTP rejection. Spam placement happens after acceptance; an SMTP rejection means the provider did not accept the message.
Some public-sector policies explicitly require DMARC and may specify p=reject. PCI DSS instead requires broader automated anti-phishing protections and lists DMARC as one example control. Audit outcomes depend on the standard, its scope, and the complete control set.
Some insurers, enterprise procurement teams, and security assessors ask about email authentication even when no formal mandate applies. Treat that as an organisation-specific expectation, not proof that every regulator or contract requires DMARC.
The correct next step depends on the requirement. A mailbox-provider baseline may accept p=none, an explicit public-sector mandate may require p=reject, and an industry standard may require a broader set of controls rather than DMARC specifically. Monitoring provides the evidence needed to move policy safely.
| If you… | DMARC is… | Why |
|---|---|---|
| Send about 5,000 messages/day to personal Gmail, or more than 5,000/day to Outlook consumer addresses | Required | Provider sender rules require DMARC; enforcement outcomes differ |
| Send bulk mail to Yahoo, AOL, or iCloud Mail users | Required | Both publish DMARC requirements without a numeric bulk threshold |
| Are in scope for PCI DSS Requirement 5.4.1 | Example control | DMARC is one example within a broader anti-phishing requirement |
| Are a covered US federal civilian executive-branch agency | Required | CISA BOD 18-01 requires p=reject |
| Run internet email domains for a UK public-sector organisation | Required | UK guidance requires DMARC, DKIM, SPF, reporting, and inbound enforcement |
| Are a Danish state authority | Required | Technical minimum requirements specify p=reject across owned domains |
| Send any volume of email from a domain you care about | Recommended | Protects against spoofing and improves deliverability |
| Have a domain but don't send email from it | Recommended | A p=reject record prevents others from spoofing it |
Without a DMARC policy at quarantine or reject, anyone can spoof your domain in the visible From address, the name your recipients actually see. This is the vector used in business email compromise (BEC) and targeted phishing attacks.
p=reject without monitoring means legitimate sources you've forgotten about will silently stop delivering. Monitoring makes the journey safe.Multiple domains, complex sending infrastructure, compliance requirements, and SOC teams that need DMARC data in their existing tooling — not another dashboard to watch.
Manage DMARC monitoring across all your clients from a single platform. Per-domain configuration, alerting, and reporting. White-label friendly API.
REST API, MCP server, webhooks, and JSON export. Pipe DMARC data directly into your infrastructure. No SaaS lock-in, no forced workflow changes.
Affordable, simple monitoring for a single domain. Get the compliance and security benefits of DMARC without needing a dedicated security team to manage it.
Financial services organisations face broad ICT and phishing-risk obligations, but frameworks such as DORA do not prescribe DMARC. Monitoring can evidence one bounded email-authentication control within a wider security programme.
Some public-sector policies explicitly require DMARC, but their scope and policy level differ. UK guidance and the US and Danish mandates each define their own covered organisations and controls.
High email volumes across multiple subdomains and third-party senders make DMARC monitoring essential. Many students and alumni use personal Gmail or Yahoo accounts — exactly the inboxes covered by the bulk sender requirements.