DMARC Compliance & Regulations
Gmail, Yahoo and Outlook.com require DMARC from bulk senders. US federal agencies must publish p=reject. PCI DSS 4.0 asks for anti-phishing controls. Here is what each one actually says.
Why DMARC Compliance Matters
Stop exact-domain spoofing
At p=quarantine or p=reject, receivers that check DMARC stop or junk mail that claims your domain in the From line but fails SPF and DKIM alignment.
Keep bulk mail deliverable
Gmail, Yahoo and Outlook.com ask high-volume senders to publish DMARC and to pass SPF or DKIM alignment. Mail that misses these rules can be rejected or sent to spam.
Show a working control to auditors
Most security laws ask for appropriate controls without naming DMARC. An enforced policy plus report history is clear evidence of an anti-spoofing control.
DMARC requirements by provider and regulation
Who asks for DMARC, and exactly what they ask for. Each name links to the source we read on 19 October 2026.
| Regulation | Requirement | Region | Industry |
|---|---|---|---|
| Gmail sender guidelines | All senders: SPF or DKIM. Bulk senders (about 5,000+ a day to Gmail): SPF, DKIM and DMARC, at least p=none, with alignment | Global, enforced from February 2024 | Anyone sending to Gmail accounts |
| Yahoo sender best practices | Bulk senders: SPF, DKIM and a DMARC policy, with alignment | Global, enforced from February 2024 | Anyone sending to Yahoo and AOL |
| Outlook.com high-volume senders | Over 5,000 a day: SPF, DKIM and DMARC at least p=none, aligned with SPF or DKIM | Global, enforced from May 2025 | Anyone sending to Outlook.com, Hotmail and Live |
| CISA BOD 18-01 | DMARC p=reject on every second-level domain and mail-sending host | US federal civilian agencies | Government |
| PCI DSS 4.0, requirement 5.4.1 | Automated mechanisms to detect and protect staff against phishing. The guidance cites DMARC, SPF and DKIM as examples | Global, mandatory from March 2025 | Companies that store, process or transmit card data |
| GDPR, DORA, NIS 2, HIPAA, GLBA | Do not name DMARC. They require appropriate security controls, and DMARC is a common way to show an anti-spoofing control | EU and US | Varies by law |
How DMARC+ Helps You Achieve Compliance
Monitor Phase
Start with a p=none policy to collect DMARC reports. See every sender using your domain and identify authentication gaps before enforcing restrictions.
Enforce Phase
Move to p=quarantine, then p=reject, once all legitimate senders pass authentication. Receivers then stop or junk mail that fails.
Continuous Compliance
Monitor reports on an ongoing basis. New services, vendor changes, and configuration drift create gaps over time. Keep reading reports after enforcement.
Frequently Asked Questions
Achieve DMARC compliance today
DMARC+ monitors your DMARC reports, identifies unauthorized senders, and guides you to full enforcement.
Start Your 14-Day Trial