DMARC policy not applied
Published policy is not observed as expected by receivers.
Problem summary
Published policy is not observed as expected by receivers.
Symptoms
- p=reject published but spoof samples still inbox
- pct less than 100 leaves a pass-through slice
- Some receivers delay or differ on disposition
Possible causes
- pct ramp still below 100
- Message actually passed DMARC (false expectation)
- Receiver-specific handling or overrides
- Stale cached DMARC at some resolvers during change
How to diagnose
- Confirm live _dmarc p= and pct
- Inspect Authentication-Results disposition on the sample
- Retest after TTL with a known failing spoof sample
How to fix
- Raise pct deliberately once ready
- Fix record mistakes (wrong domain, syntax)
- Accept that not every UI will label disposition the same way — trust headers/reports
How to verify
- Failing samples show expected quarantine/reject disposition where the receiver supports it
- rua reflects enforced disposition consistently
Prevention
- Document pct meaning for stakeholders
- Verify with headers, not inbox folklore alone
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts