Setting up DMARC: find every legitimate sender first.
Identify your domain's sending routes, align SPF, DKIM and DMARC, and investigate rejected or unusual business email.
Read the German originalOne domain can have many senders
Staff mailboxes, the shop, invoicing software and newsletters may all send using the same domain. Looking only at the main mail server can easily miss one of these routes. A new authentication policy may then block important business messages.
Google distinguishes requirements for general senders and bulk senders. SPF, DKIM and DMARC have different roles. The actual sending services and received email headers help establish which settings are missing.
The error message points to the cause
For a specific incident, collect the time, sending service and sanitised response. Was the message rejected, delayed or put in spam? These observations lead to different checks. The contents of a confidential customer email are not initially needed.
Check authentication on the sending route that was actually used. Correct DNS settings for a domain do not establish whether every application sends with the intended identity. Forwarding and external email services can also affect the result.
Introduce a stricter policy gradually
After identifying senders, review test messages and reports. Only then can you decide how to introduce a stricter DMARC policy. Establish a fallback for a discovered legitimate exception beforehand.
Delivery still depends on other factors even when authentication passes. A useful result therefore distinguishes resolved errors from open causes. Ongoing support is particularly helpful when new applications frequently send on behalf of the domain.
What does this look like in your work?
We can turn the idea into a sensible next step with you.
DMARC & dependable email delivery · Packages