Domain-based Message Authentication, Reporting , and Conformance (DMARC)

What it's mean ?

DMARC—an improved standard for protecting your brand name—stands for “Domain-based Message Authentication, Reporting , and Conformance” and is a protocol for email authentication, policy, and reporting . It builds on the widely deployed SPF and DKIM protocols.

If you want to protect your domain with DMARC or use DMARC to filter out spam , and you use Office 365Exchange online protection, note that Microsoft has decided to modify its standard DMARC policy. Suppose a domain is protecting itself and a forged message is identified as DMARC=fail, with the policy set to reject 100% of such messages. Example DMARC policy: v=DMARC1;p=reject;pct=100

In this case Office 365 it will ignore the "reject" status and deliver the email marked as " spam." The header will contain “dmarc=failaction=oreject”(where “oreject” overrides “reject”).

Here is how Microsoft justifies this design decision

“If the DMARC policy of the sending server is p=reject, EOP marks the message as “ spam ” instead of rejecting “ it.” In other words, for inbound email, Office 365 EOP treats `p=reject` and `p=quarantine` the same way.

Office 365 It is configured this way because some legitimate email may fail DMARC. For example, a message might fail DMARC if it is sent to a mailing list that then relays the message to all list members. If Office 365 these messages were rejected, people could lose legitimate email and have no way to retrieve it. Instead, these messages will still fail DMARC but will be marked as “ spam ” and not rejected. If desired, users can still receive these messages in their inbox using the following methods:

• Users Add safe senders individually using their email client
• Administrators create a Exchange mail flow rule (also known as a transport rule) for all users that allows messages from those specific senders.”

https://docs.microsoft.com/en-us/office365/securitycompliance/use-dmarc-to-validate-email#inbounddmarcfail