DMARC tells receiving servers what to do when SPF or DKIM checks fail (reject, quarantine, or do nothing) and who to send failure reports to. "Alignment" means the domain in the From: header matches the domain that SPF/DKIM actually authenticated.
DMARC is the enforcement layer — SPF and DKIM alone don't stop spoofing, DMARC does. As of 2024, Google and Yahoo require DMARC for any sender doing 5,000+ messages/day.
Policy set to "p=none" indefinitely (monitoring only, no real protection), no rua/ruf reporting address configured, alignment mismatches after a rebrand.
Run a free, instant audit of DMARC and every other authentication record on any domain.
Run a Free DMARC CheckA competitor moving from p=none to p=quarantine or p=reject is a visible sign they're maturing their email program — useful competitive intelligence, not just a security detail.