How does DMARC affect a message after it is sent?
The receiving server compares the domain in the From field with the domain authenticated by SPF or DKIM. If you write from sales@company.ru but the DKIM signature belongs to an unrelated technical domain, the check may fail. Your DMARC policy tells the server whether to accept that message, treat it as suspicious, or reject it.
| Signal | What the recipient server sees | Practical result |
|---|---|---|
| SPF or DKIM aligns with From | The sender is authenticated | The message passes the technical check |
| Authentication does not align | The sender address is uncertain | Filtering or rejection becomes more likely |
| DMARC reports are enabled | Sending sources are visible | You can identify an unexpected service or configuration error |
DMARC does not make a weak offer convincing or guarantee Inbox placement. It addresses a different part of the job: proving that your domain is authorised to send the message. Check it alongside <a href="/en/glossary/spf/">SPF</a> and DKIM before loading the first batch of contacts.
Which policy should you start with?
Applying a reject policy to a domain before mapping its senders can block more than outreach. It may also disrupt messages from your CRM, website forms, HR tools, accounting systems, or regular corporate mail. First identify legitimate senders, then verify domain alignment, and only then strengthen the policy.
- Publish a DMARC record in monitoring mode with p=none and an address for aggregate reports.
- Use the reports to identify every IP address and service sending mail for the domain.
- Configure SPF or DKIM for each legitimate source so its domain aligns with the From address.
- After reviewing several reporting cycles, decide whether quarantine or reject is appropriate.
The same order applies to a separate domain used for outbound outreach: verify first, then send. If reports show a service your team did not knowingly connect, do not change the record blindly; establish whether it is an old legitimate integration first. For campaign infrastructure, this belongs within an <a href="/en/services/email-deliverability/">email deliverability review</a>.
Which mistakes break DMARC in a cold-email campaign?
A common mistake is enabling DKIM through a provider while keeping a primary domain in From when the signature uses another domain. Another is publishing a second SPF record instead of combining authorised mechanisms, which can create a conflict. A third is enforcing a strict policy without checking mail sent by the website and CRM.
A company sends from hello@new-company.ru. The message carries a DKIM signature for mailer-service.net, and SPF passes for that service but does not align with new-company.ru. A decision-maker asks for the email again because it was treated as suspicious. The issue is not the subject line; the sender domain is not confirmed by an aligned authentication signal. After setting up a DKIM signature for the sending domain, check the headers of a test message before starting another wave.
Do not confuse a technical diagnosis with list quality. An invalid address creates a <a href="/en/glossary/bounce-rate/">bounce</a> even when DMARC is correctly configured, while an irrelevant email can receive a refusal despite passing authentication. Both sides need review when diagnosing a campaign.
Where DMARC is not the answer
DMARC is not a quick way to increase replies or repair the reputation of a domain that has already accumulated negative signals. It does not replace address verification, a valid reply address, or a clear reason to contact a specific person. If your email reaches the wrong decision-maker or carries a generic offer, authentication only proves that you sent it.
- Do not enable reject until you have checked the website, CRM, mailing service, and corporate mail.
- Do not treat missing DMARC as the only reason for spam placement without reviewing headers and rejections.
- Do not use your primary domain for an experiment while its legitimate senders have not been mapped.
When the task is to prepare separate infrastructure for a campaign, DMARC should be configured alongside domain preparation and test sends. It is a control process, not a magic button.