While using DMARC reporting, your organization might face an issue of Policy Overrides. In simple terms, a DMARC policy override occurs when an email receiver chooses to override the policy you defined in your DMARC record.

For instance, your domain has a reject (p=reject) policy, and the email you sent went through a mailing-list, which violates both SPF and DKIM. DMARC will fail in this situation, but the recipient may choose to override your policy and accept the email. The following are some of the most prevalent DMARC override scenarios:

forwarded emails: Message was forwarded via a known forwarder or local examination revealed that the message had probably been forwarded. Authentication should not be expected to pass, in such a scenario.

Local policy: The mail was exempted from the Domain Owner's required policy action due to the Mail Receiver's local policy. They have exempted your domain from their gateway since they are not checking your DMARC authentication.

Mailing_List: local examination revealed that authentication of the original message was unlikely to succeed. Therefore, the authentication of the original message was not expected to pass.

Sampled_out: The message was exempted from application of policy by the “pct” setting in the DMARC policy record.

Trusted_forwarder: Message authentication failure was predicted by other evidence connecting the message to a locally-maintained list of known and trusted forwarders.