DMARC implementation: what actually makes mailbox protection work?

TL;DR: DMARC implementation only works when SPF and DKIM are fully inventoried, aligned and monitored, according to Valimail, because partial deployment leaves spoofing paths open while legitimate senders continue to fail authentication. Enforcement succeeds when governance, reporting and sender lifecycle control are treated as one programme, not separate tasks.

Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “DMARC implementation: How to protect your domain in 6 steps”.

Key questions

Q: How should security teams roll out SPF, DKIM, and DMARC without breaking legitimate email delivery?

A: Start by inventorying every system that sends mail on behalf of the domain, then publish SPF and DKIM for those senders before moving DMARC from monitor mode to enforcement.

Q: Why can a legitimate email still fail DMARC even when SPF and DKIM both pass?

A: DMARC only counts SPF or DKIM when the authenticated domain aligns with the domain shown in the From header.

Q: What are common mistakes with DMARC Policy?

A: Common DMARC Policy mistakes are publishing policy before SPF and DKIM alignment is working, moving too quickly to reject, and forgetting to monitor reports for legitimate senders that fail authentication.

Practitioner guidance

• Document every authorized sender Build and maintain a complete inventory of mail servers, SaaS platforms, notification services and subdomains that send on behalf of the domain.
• Publish SPF with explicit sender scope List only approved IPs and sending domains, then use the strictest qualifier that will not break legitimate mail after testing.
• Deploy DKIM per sender and subdomain Generate separate signing keys for each service that sends mail so delegated systems can be rotated or removed without affecting the rest of the estate.

Bottom line: DMARC only reduces impersonation risk when every legitimate sender is inventoried, aligned and continuously governed.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →