DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a TXT record at _dmarc.<domain> that tells receivers what to do when SPF or DKIM checks fail and where to send aggregate reports.

DMARC Policy Check for infra.gov.sa

DMARC record looks good

Raw record

v=DMARC1; p=reject; fo=1; rua=mailto:haseen@rua.dmarc.gov.sa,mailto:security@deem.sa,mailto:soc@nic.gov.sa; ruf=mailto:haseen@ruf.dmarc.gov.sa,mailto:security@deem.sa,mailto:soc@nic.gov.sa;

Policy p=reject — failing mail is rejected outright by receivers.

v	DMARC1	provided
p	reject	provided
sp		default
pct	100	default
adkim	r	default
aspf	r	default
fo	1	provided
rua	mailto:haseen@rua.dmarc.gov.sa, mailto:security@deem.sa, mailto:soc@nic.gov.sa

The policy values p=none / p=quarantine / p=reject move from observation to enforcement. p=none reports issues without acting; p=quarantine routes failing mail to spam; p=reject blocks it outright. The pct= modifier scales enforcement (start at low pct=, ramp up).

Start with p=none + a working rua= reporting address to gather data without disrupting mail flow. Once reports show clean SPF + DKIM alignment for legitimate senders, ramp pct from 25 to 100 under p=quarantine, then promote to p=reject. Without a reporting address, DMARC enforcement is blind.