DMARC at p=reject is what actually stops exact-domain spoofing. Gmail and Yahoo require at least p=none for bulk senders, and BIMI requires p=quarantine or p=reject.
The metrics that matter#
- Authentication pass rate: share of mail passing SPF, DKIM, and DMARC alignment. Healthy: 99% or higher.
- Spam complaint rate: Gmail enforces at 0.3%; stay under 0.1%.
- Hard bounce rate: under 2%; above 5% triggers platform reviews.
- Inbox placement: above 90% across major providers via seed tests.
- Engagement: click and reply rates by segment; opens are unreliable after Mail Privacy Protection.
Where to read them#
- Google Postmaster Tools for Gmail domain reputation, spam rate, and authentication.
- Microsoft SNDS and JMRP for Outlook.com IP reputation and complaints.
- Your ESP's delivery and bounce reports.
- DMARC aggregate reports for authentication by source.
Improving the numbers#
- Confirm SPF and DKIM are deployed and aligned for every legitimate sender.
- Publish _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to begin collecting reports.
- Analyze aggregate (RUA) reports for 2 to 4 weeks to identify unauthenticated legitimate sources.
- Fix each source, then move to p=quarantine with pct=25, ramping to 100.
- Move to p=reject and add sp=reject to cover subdomains.
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-rua@example.com; adkim=s; aspf=s; pct=100"Frequently asked questions#
What is DMARC alignment?
The domain in the visible From header must match (exactly or organizationally) the domain that passed SPF or DKIM. Set adkim=s and aspf=s for strict matching.
How long until I can reach p=reject?
Typically 4 to 12 weeks depending on how many third-party senders you have to fix.
What are RUA and RUF reports?
RUA are daily aggregate XML reports of pass/fail counts per source. RUF are per-message forensic samples; many receivers no longer send them.