Email authentication

SPF lists which hosts may send mail for the domain. DKIM attaches a signature the receiver checks against a public key in DNS. DMARC tells the receiver what to do when those do not align with the visible From. p=none means watch, do not act. Policy is quarantine or reject once the legitimate senders are in the records.

First principles

Anyone can put your domain in the From line. Receiving servers will believe it unless the three records work together. SPF is Sender Policy Framework. DKIM is DomainKeys Identified Mail. DMARC is Domain-based Message Authentication, Reporting and Conformance.

Alignment is the point. A signature from a vendor's domain does not protect your From if DMARC cannot see that the domains match. SPF that ends in +all is a welcome mat. DKIM without DMARC is a signature nobody is required to honour.

p=none is not a policy

DMARC p=none means 'watch, do not act'. It is how you start: collect reports, find the senders you forgot (the CRM, the invoice platform, the printer). It is not where you stop. Leaving p=none forever advertises that spoofed mail should still be delivered. Policy is p=quarantine, then p=reject, once the legitimate senders are in SPF and DKIM.

What an admin actually does

• Inventory every system that sends as you: mail server, SaaS, marketing, ticketing, scanners. Each one in SPF and/or DKIM.
• Publish DMARC at p=none with a rua mailbox you actually read. Fix the gaps the reports show.
• Move to quarantine, then reject. Set a date. 'Forever none' is the failure mode.
• SPF has a lookup limit. Flatten or include carefully. Do not keep adding vendors until the record silently fails.