SPF, DKIM, DMARC, BIMI implementation

[Mark_Wallace1]

I have SPF and DKIM, am I correct that to add DMARC I just need to add to the sending domain DNS the correct DMARC txt record with p=none initially?

And then the reports are sent to the email defined in the txt?

Thanks

[SanfordWhiteman · Accepted solution]

Provisionally: Yes.

BUT...

You need to define “the sending domain” exactly. DMARC defines the sender as the From: header, not the envelope sender (MAIL FROM:). And SPF never looks up the From: header domain — ever.

Somewhat confusingly, this doesn’t mean that DMARC as a whole is unrelated to the MAIL FROM: domain!

See, if you happen to have “branded envelope sender“ purchased/enabled in Marketo, then the SPF component of DMARC validation becomes indirectly linked to your From: domain. DMARC implicitly checks if the message passes SPF for the From: domain. This can only happen if if the MAIL FROM: matches/partially matches the From:.

Overall, it’s impossible to fully recommend you pubbing a DMARC policy without knowing your precise configuration, not only in Marketo but for other email sources (i.e. your corporate mailserver will also be affected by DMARC unless your From: domain is only used by Marketo).