DMARC requirements for BIMI

What enforcement means

A policy of p=none only requests reports; it does not ask receivers to quarantine or reject unauthenticated mail. BIMI therefore expects quarantine or reject. OpenBIMI checks for pct=100 because that is the most widely documented provider requirement.

• p=quarantine: ask receivers to treat failing mail as suspicious.
• p=reject: ask receivers not to accept failing mail.
• pct=100: apply the requested policy to all relevant mail.

Alignment is checked per message

A public DNS checker can inspect policy, but it cannot prove that a particular message passes DMARC. At least one authentication path must align with the visible From domain: SPF alignment or DKIM alignment.

Roll out safely

Start by identifying every platform that sends as your domain. Use aggregate DMARC reports to find authentication gaps, fix or remove unknown sources, then increase enforcement in controlled steps.

• Do not copy a reject policy blindly onto a production domain.
• Make sure marketing, support, invoicing, CRM, and transactional platforms are included.
• Keep report destinations maintained and monitor changes after enforcement.