1. Start with three domain names

Write the visible From domain, the SPF-authenticated domain, and each DKIM signing domain on separate lines. Compare identities before investigating policy strength. A passing result associated with another organization’s domain may not be the identity you meant to validate.

Visible From:       example.com
SPF identity:      sender.example.net  → pass
DKIM signing d=:   example.com         → pass

In this simplified case, the matching DKIM identity is the useful evidence to investigate for alignment. Keep the receiver’s actual DMARC result as part of the record.

2. Inspect the policy without changing it

Read the DMARC policy at the relevant DNS name and note the published handling request. Policy discovery, subdomain relationships, and deployed receiver behavior need care; do not reduce every investigation to a string comparison or a policy-strength badge.

Monitoring and enforcement serve different operational purposes. A stronger policy is not a substitute for making legitimate sending services authenticate correctly. Before tightening handling, identify business-critical senders and test their actual mail paths.

3. Check the age of the advice you are following

RFC 9989 replaced the earlier DMARC specification in May 2026. It removes the old pct tag. If an older tutorial recommends percentage-based rollout, check the current standard and your receiving ecosystem instead of assuming that behavior is portable.

This matters during migrations: a correct reading of the latest protocol does not prove every deployed receiver has already adopted it. Record the specification and the observed implementation separately.

4. Retest the specific sender

If the passing identity does not align, ask the sending service about a supported custom return-path or aligned DKIM configuration. Prefer a documented provider setup to speculative DNS changes. Send a new test and keep the before/after evidence.

Even a DMARC pass does not establish that a message is wanted, harmless, or destined for the inbox. The next investigation may concern permission, complaints, reputation, or message expectations.

Before you move on

  • Visible and authenticated identities recorded.
  • Receiver result preserved.
  • Current standard separated from legacy advice.
  • Legitimate senders verified before enforcement changes.