DMARC policies for cold email outreach

Cold outreach operates with no prior consent and therefore no goodwill. Every technical and behavioral signal, including DMARC policies, is weighted more heavily by mailbox providers.

What DMARC policies are#

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails SPF and DKIM alignment, and asks them to send aggregate and forensic reports back to the domain owner.

Why it matters#

DMARC at p=reject is what actually stops exact-domain spoofing. Gmail and Yahoo require at least p=none for bulk senders, and BIMI requires p=quarantine or p=reject.

Applying DMARC policies to outbound#

1. Confirm SPF and DKIM are deployed and aligned for every legitimate sender.
2. Publish _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to begin collecting reports.
3. Analyze aggregate (RUA) reports for 2 to 4 weeks to identify unauthenticated legitimate sources.
4. Fix each source, then move to p=quarantine with pct=25, ramping to 100.
5. Move to p=reject and add sp=reject to cover subdomains.

_dmarc.example.com.  IN TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-rua@example.com; adkim=s; aspf=s; pct=100"

Outbound-specific guardrails#

• Send from secondary domains, never the primary company domain.
• Cap each mailbox at 30 to 50 sends per day.
• Stop sequences on any reply, including informal opt-outs.
• Track reply rate as your primary quality metric.

Common mistakes#

• Jumping straight to p=reject and blocking your own invoicing or HR system.
• Sending RUA reports to a mailbox nobody reads; use a report processor.
• Leaving subdomains uncovered because sp= was never set.
• Assuming p=none provides protection; it is monitoring only.

Frequently asked questions#