DMARC Compliance Requirements

Here are some of the global DMARC compliance requirements:

Microsoft Bulk Sender Requirements

On May 5, 2025, Microsoft began requiring senders delivering over 5,000 daily messages to Outlook.com, Hotmail.com, or Live.com to implement SPF, DKIM, and DMARC. Non-compliant messages are rejected at the SMTP level with the error "550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." A DMARC policy of at least p=none, with alignment under SPF or DKIM, satisfies the requirement.

Google Bulk Sender Requirements

Beginning in 2024, Google required general senders to use SPF or DKIM, and bulk senders (those sending over 5,000 messages per day to Gmail accounts) to fully implement DMARC, SPF, and DKIM, along with additional requirements such as one-click unsubscribe and low spam rates.

Yahoo Bulk Sender Requirements

As of February 2024, Yahoo required bulk senders to implement DMARC, SPF, and DKIM, along with additional requirements and best practices.

Apple (iCloud Mail) Requirements

To send bulk email to iCloud Mail users, SPF, DKIM, and DMARC implementation is expected. Like other major providers, Apple also expects adherence to additional email-sending best practices.

Digital Operational Resilience Act (DORA)

DMARC is not explicitly required under DORA, but it supports DORA's goals by mitigating phishing and spoofing risks, thereby strengthening overall domain security and operational resilience.

PCI DSS v4.0

Although DMARC is not explicitly required in PCI DSS v4.0, it can support compliance with Requirement 5.4.1, which calls for mechanisms to detect and protect against phishing attacks for entities handling cardholder data.

ISO/IEC 27001

ISO/IEC 27001 does not explicitly mandate DMARC, but implementing it supports compliance by strengthening email threat detection and risk management. DMARC enhances visibility and protection against spoofing, aligning with the standard's focus on proactive information security controls.

The High Stakes: Biggest DMARC Compliance Risks

When you fail to meet DMARC compliance requirements, you are likely to face numerous risks, including:

• Increased risk of spoofing, phishing, and impersonation
• Higher chances of regulatory fines stemming from data breaches
• Poor email deliverability and higher bounce rates
• Damage to brand reputation and customer trust

In the context of cyber insurance, implementing DMARC (particularly at enforcement) can demonstrate strong email security practices, which may positively influence premium assessments, eligibility, and claim evaluations for email-related incidents.