Guides / DMARC policy for cold email: what to publish and when
DMARC policy for cold email: what to publish and when
DMARC is the record that ties SPF and DKIM to the address people see in the From line, and tells receivers what to do when a message fails. For cold emailers it matters for two reasons: Gmail and Yahoo expect it from larger senders, and a failing or missing DMARC setup is one of the easier things to fix. Here is how the policies work and a cautious way to roll one out.
What DMARC actually checks
DMARC passes if at least one of two things is true: SPF passes and the SPF domain aligns with the From domain, or DKIM passes and the DKIM signing domain aligns with the From domain. Alignment is the part people miss. A message can pass SPF and DKIM for your sending tool's domain and still fail DMARC for yours.
The DMARC record is a TXT record published at _dmarc.yourdomain.com.
The three policies
p=none: monitor only. Failing messages are not treated differently because of DMARC. You can still receive reports.p=quarantine: ask receivers to treat failing messages as suspicious, typically delivering them to spam.p=reject: ask receivers to refuse failing messages.
Receivers make the final call, and the policy is a request, not a guarantee.
What Gmail and Yahoo require
Google's sender guidelines say that senders sending more than 5,000 messages a day to Gmail accounts must publish DMARC, and that the policy can be none. Yahoo's requirements for bulk senders likewise call for a valid DMARC policy of at least p=none, with a rua reporting address recommended. Both say the From domain must align with the SPF or DKIM domain.
Many cold email senders send well under those volumes, but publishing a record is cheap and avoids a missing-DMARC flag in checkers. Check current requirements on Google's and Yahoo's own pages, as they can change.
A safe starting record
A common first record is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The rua address receives aggregate XML reports from receivers, which show which servers sent mail as your domain and whether it passed. Make sure the mailbox exists. Raw reports are hard to read, so many people use a free report-parsing tool.
When to move to quarantine or reject
Stay on p=none until your reports show that all your legitimate sources pass with alignment. That includes your mailbox provider, your sending tool, and any CRM, billing or helpdesk tool that sends as your domain. Then you can move to p=quarantine, optionally using pct= to apply it to a fraction of mail at first. If everything stays clean, p=reject is the strongest setting.
For a dedicated cold email domain that sends only a few known streams, going to enforcement is relatively low risk. For your main company domain, which has many senders, be more careful, because a missed sender will have its mail quarantined or rejected.
Does a stricter policy improve cold email placement?
Some deliverability guides claim that enforcing DMARC improves inbox placement. We have not seen firm public evidence from Google or Yahoo that reject itself raises placement for compliant senders, so we would not promise it. What does matter is that your messages pass authentication consistently. Enforcement does protect your domain from being spoofed, which can protect your reputation.
Subdomains and the sp tag
A DMARC policy on the organizational domain applies to subdomains unless you set sp= to give subdomains a different policy, or publish a separate record at _dmarc.sub.yourdomain.com. If you send cold email from a subdomain, check which record applies.
Common mistakes
- No record at all, or the record at the wrong name (it must be at
_dmarc). - Multiple DMARC records on the same name.
- Jumping straight to
rejectbefore checking every sender. - A
ruaaddress at a domain that is not set up to receive reports. - Relying on SPF alone while the tool's SPF domain never aligns. Set up custom DKIM instead.
Frequently asked questions
Do I need DMARC to send cold email?
It is strongly advisable. Gmail and Yahoo require it for bulk senders, and a missing record is a common finding in deliverability checks. Smaller senders are not always required to have it, but it is cheap to add.
Is p=none enough?
It meets the stated minimum for Gmail and Yahoo bulk senders. It does not protect your domain from spoofing, since it requests no action on failures.
Can DMARC break my own email?
Yes, if you enforce a policy before every legitimate sender passes with alignment. That is why starting at p=none and reading reports first is the safer approach.
Where do I publish a DMARC record?
As a TXT record at _dmarc.yourdomain.com.