DMARC at p=reject: list every sender first, then enforce.

The facts

Where do India’s largest companies stand on DMARC?

If your finance team sends invoices from your domain, anyone can put that domain in the From line of a forged email. DMARC is the DNS record that tells receiving servers what to do when such mail fails authentication. Its current standard, RFC 9989, was published in May 2026². Reaching p=reject is mostly the work of finding every system that sends as you, before the policy tightens.

Proofpoint analysed the 2025 Fortune 100 India list in June 2026: 97% of those companies had some DMARC protection¹. Reject was in place at 59%, quarantine at 32% and monitor-only at 6%, so 41% did not ask receivers to refuse failing mail¹. The release covers large companies only and gives no method beyond the list and the month.

The policy tag, p, takes three values². With none, the domain owner “offers no expression of preference”. Quarantine says failing mail is “suspicious”. Reject says a failure is “a clear indication that the use of the domain name is not valid”².

Mail passes DMARC when SPF or DKIM passes for a domain that aligns with the visible From address². Alignment is what trips up third-party senders. A vendor’s server can pass SPF for its own domain and still fail DMARC for yours.

The facts

What do Gmail and Outlook.com now require from senders?

Google and Microsoft have made DMARC a delivery condition for domains that send about 5,000 or more messages a day to their consumer mailboxes³⁴⁵.

Two Gmail details matter for B2B senders. A sender that crosses the threshold once is “permanently considered” a bulk sender⁵. And the guidelines do not apply to mail sent to Google Workspace accounts, only to personal Gmail⁵.

Google’s FAQ says that from November 2025 “Gmail is ramping up its enforcement on non-compliant traffic”, including temporary and permanent rejections⁵. Microsoft first planned to send failing mail to Junk. Its update of 29 April 2025 says such mail is rejected instead, from 5 May 2025⁴.

The facts

What changed in the DMARC standard in May 2026?

RFC 9989 obsoletes RFC 7489 and puts DMARC on the IETF Standards Track². The version tag stays v=DMARC1². Three changes touch a rollout plan.

First, the pct tag is gone. It was meant to apply a policy to a share of failing mail. The RFC says it “was usually not accurately applied, unless the value specified was either 0 or 100”².

Second, a new t tag takes over part of its testing role: t=y asks receivers to apply one level below the stated policy². Third, the np tag, carried over from the experimental RFC 9091, sets the policy for subdomains that do not exist².

The RFC is blunt about SPF. Domains that publish p=reject “MUST NOT rely solely on SPF to secure a DMARC pass” and “MUST apply valid DKIM signatures”². The reason is forwarding: relayed mail tends to fail SPF, while DKIM signatures generally survive².

SPF has a ceiling of its own. One SPF check may use at most 10 terms that cause DNS lookups: include, a, mx, ptr, exists and redirect⁷. Past that, the check returns permerror⁷.

DMARC acts on exact-domain spoofing: the RFC says it “does not address the use of visually similar domain names” or a false display name².

The facts

Which Indian rules and figures bear on spoofed mail?

CERT-In’s Directions of 28 April 2022 list “Identity Theft, spoofing and phishing attacks” as item (vii) of Annexure I⁸. The duty to report falls on service providers, intermediaries, data centres, body corporates and government organisations⁸. Listed incidents go to CERT-In “within 6 hours of noticing such incidents or being brought to notice about such incidents”⁸. Applicability to your organisation is for your counsel.

RBI’s circular of 22 April 2025 asked banks to finish moving to the exclusive .bank.in domain by 31 October 2025⁹. IDRBT is the registrar⁹. The Governor’s statement of 7 February 2025 said a fin.in domain “for the financial sector” would follow¹⁰.

Business email compromise drew 24,768 complaints to the FBI’s IC3 in 2025 and US$3,046,598,558 in reported losses¹¹. Only investment fraud reported larger losses¹¹. Among countries outside the US, India had the second-highest number of complaints: 5,879 across all crime types¹¹.

Between January and March 2026, Sophos surveyed IT and security leaders at 240 Indian organisations hit by ransomware in the previous year¹². Malicious email was the most common technical root cause, in 28% of attacks, followed by phishing at 26%¹².

What it means

What is exposed below reject, and what can enforcement break?

Below reject, a receiver has no instruction from you to refuse a forged message that carries your domain. That is the message finance teams worry about: an invoice, or a request to change bank details, that appears to come from you.

Enforcement cuts the other way too. Any system that sends as your domain without aligned DKIM or SPF can be bounced or sent to spam once the policy tightens. The list runs past the mail platform: ERP, HRMS and payroll, CRM, marketing tools, helpdesks, scanners and vendors who send statements in your name.

Your own platform may not be signing either. Microsoft’s documentation says “no DKIM signing occurs for outbound mail from custom domains” until you configure it¹³. It also recommends a subdomain for bulk email services you do not control, so their reputation stays apart from your main domain¹³.

Each include you add to SPF for a vendor spends at least one lookup. Past 10, SPF returns permerror, so a long include list can break the mail it was meant to authorise⁷. A DKIM key per sender avoids that ceiling.

The .bank.in deadline passed on 31 October 2025⁹. A bank that has moved has two domains to protect. The new one needs its own DMARC, SPF and DKIM records. The old one still looks genuine to customers, so once nothing sends from it, treat it as a parked domain.

We found no RBI circular that sets a date for fin.in when we checked in October 2026. The February 2025 statement said only that it would follow¹⁰.

What it means

What should the team check, in order?

1. List every domain you own, from the registrar account and the DNS zones, and mark which ones send mail.
2. Publish a p=none record with a rua address on each sending domain, and route the reports to a parser or a mailbox someone reads².
3. Read the aggregate reports until every source that sends as you has a name and an owner.
4. Ask finance, HR, sales and marketing which systems send invoices, payslips, statements and campaigns. Some senders only appear at month-end.
5. Turn on DKIM for your domain in Microsoft 365 or Google Workspace, with 2048-bit keys where your DNS host supports them¹³¹⁴.
6. Give each third-party sender its own DKIM key on your domain or a subdomain, and move bulk mail to a subdomain¹³.
7. Count the DNS lookups in your SPF record and keep them at 10 or fewer⁷.
8. Publish p=reject and v=spf1 -all on every domain that sends no mail, plus a null MX where it receives none either¹⁵.
9. Move a domain to p=quarantine once every legitimate source passes with aligned DKIM, then to p=reject when the reports stay clean².
10. Check sp and np: without them, subdomains take the p policy, which may not be what you intend².
11. Watch for bounces carrying 4.7.30, 4.7.32, 5.7.30 or 550 5.7.515 after each change⁵⁶.
12. Write one rule into accounts payable: confirm any change of bank details by calling a number already on file.

Our view

Where would we start, and when does p=reject not fit?

Limits

What does this article not cover?

Where we fit

Who can check your sender inventory?

Sender authentication sits within our identity and access management work. The identity review looks at email protection alongside accounts, admin rights, vendor logins and multi-factor coverage. It is free, and the written findings are yours to keep.