How are DMARC enforcement requirements evolving?

DMARC enforcement requirements are evolving toward stricter policies becoming standard. While current requirements mandate DMARC at minimum p=none, industry direction points toward expecting p=quarantine or p=reject as baseline for bulk senders.

Google has indicated plans to tighten DMARC expectations over time. Starting with monitoring mode (p=none) allows senders to identify authentication issues, but the long term expectation is enforcement policies that actively protect against domain spoofing.

Senders should plan for progressive DMARC tightening. Implement DMARC at p=none initially, analyze aggregate reports to identify authentication gaps, fix issues, then advance to p=quarantine and eventually p=reject. This progression prepares for future requirements while building domain protection.

Was this answer helpful?

Thanks for your feedback!