Direct answer
DMARC uses aligned authentication results and a published domain policy to help receiving systems handle messages. A published policy or passing result is not proof that the message's request is legitimate or that the sending mailbox is uncompromised.
Identify the organizational mail flows
Inventory the domain, subdomains and approved services that send mail on its behalf. Include support, billing and marketing providers. Confirm who manages DNS and the addresses receiving any aggregate reports before changing policy.
Reference: RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance.
Understand alignment
DMARC evaluates whether an authenticated SPF or DKIM domain aligns with the visible From domain under the published policy. A receiver's trusted authentication results can provide context for a particular message. Public DNS policy alone does not tell you whether every sender is configured correctly.
Reference: RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance.
Review changes safely
Work with mail administrators to inspect reports and test legitimate senders before tightening handling. A billing platform that sends through an unaligned domain may be affected even though its traffic is legitimate. Document owners, change window and rollback.
- Test representative services and subdomains.
- Protect report data according to the organization's policy.
- Confirm the effective DNS record and receiver results after changes.
Interpret messages separately
A DMARC pass does not verify a payment change or prove a mailbox has not been taken over. An authentication failure also needs context, including forwarding. Independently verify consequential requests through established channels.
Assessment limits
Receiver implementations and sending paths vary. Authentication results address domain identity, not the truth or safety of message content.
Frequently asked questions
Does DMARC protect against compromised real mailboxes?
A message sent through an authorized compromised mailbox may authenticate successfully. Verify consequential requests independently.
Should a policy be changed from a public scan alone?
No. Inventory legitimate senders and coordinate tests with the mail and DNS owners.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.