--- title: "How to Set Up DMARC (Step by Step) | AutoSPF" description: "To set up DMARC, first get SPF and DKIM passing and aligned, publish a DMARC TXT record at _dmarc.yourdomain.com starting at p=none with a rua address, mon" image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/dmarc/how-to-setup-dmarc/" --- # How to Set Up DMARC To set up DMARC, first get SPF and DKIM passing and aligned, publish a DMARC TXT record at \_dmarc.yourdomain.com starting at p=none with a rua address, monitor the reports, then raise the policy to quarantine and finally reject. This guide is part of our complete guide to [DMARC](/dmarc/). Related: [the DMARC record](/dmarc/dmarc-record/) and [the DMARC policy](/dmarc/dmarc-policy/). **To set up DMARC, first get SPF and DKIM passing and aligned for your domain. Then publish a DMARC TXT record at `_dmarc.yourdomain.com` starting at `p=none` with a `rua` reporting address. Monitor the aggregate reports for a few weeks, fix any legitimate senders that fail alignment, and only then raise the policy to `quarantine` and finally `reject`.** DMARC ties SPF and DKIM together and tells receivers what to do when a message fails authentication. Rushed the wrong way, it silently drops real mail. Done in the right order, it locks down your domain against spoofing without hurting deliverability. Here is the practical, step-by-step path. ## Prerequisites: SPF and DKIM first DMARC has nothing to enforce on its own. It only checks whether SPF or DKIM passed _and_ aligned with the domain in the visible From address. If neither is set up, DMARC does nothing useful, so start there. - Confirm your SPF record exists and lists every service that sends on your behalf. Use the [SPF Checker](/tools/spf-checker/) to inspect it, and follow the [SPF setup](/how-to-create-an-spf-record/) guide if you need to build or fix it. - Set up [DKIM](/dkim/) signing for each sending platform so messages carry a valid cryptographic signature that aligns with your domain. - Keep SPF under the 10-lookup limit. Too many `include:` mechanisms cause a `permerror`, which fails SPF and breaks alignment — the single most common reason DMARC blocks legitimate mail. [AutoSPF](/) flattens your record automatically so you stay under the limit as you add senders. Once SPF and DKIM both pass and align, DMARC has something real to enforce. ## Step-by-step 1. **Confirm SPF and DKIM pass and align.** Send test mail to yourself or a seed address and check the headers. Both mechanisms should authenticate, and at least one should align with your From domain. 2. **Publish a starter DMARC record.** Add a TXT record at `_dmarc.yourdomain.com` with the value `v=DMARC1; p=none; rua=mailto:dmarc@example.com`. `p=none` enforces nothing yet — it only asks receivers to report. See [the DMARC record](/dmarc/dmarc-record/) for every tag you can add. 3. **Collect and read aggregate reports.** The `rua` address receives daily XML reports from receivers listing which sources sent as your domain and whether they passed. A report viewer makes these readable. 4. **Fix any legitimate senders failing alignment.** For each real service that fails, add it to SPF, enable DKIM for it, or correct the sending domain — until every genuine source authenticates and aligns. 5. **Raise to `p=quarantine`.** Once your reports are clean, move to `p=quarantine`. Ramp gradually with the `pct` tag (for example `pct=25`, then 50, then 100) so failing mail lands in spam rather than being lost while you watch for surprises. 6. **Move to `p=reject`.** When quarantine shows no legitimate failures, set `p=reject`. Receivers now block spoofed mail outright. This is full enforcement — read [the DMARC policy](/dmarc/dmarc-policy/) to understand exactly what each policy value does. 7. **Verify your record.** Confirm the published record and syntax with the [DMARC checker](/tools/dmarc-checker/) after every change. ## How long it takes Publishing the record takes minutes; getting safely to `reject` takes weeks. Plan on two to four weeks at `p=none` just to see a full picture of your senders — many services send only occasionally, so a short window misses them. Spend another few weeks at `quarantine` with a `pct` ramp before enforcing `reject`. Large organisations with many third-party senders often take a couple of months. The monitoring is the work; the DNS changes are trivial. Rushing the timeline is what causes lost mail, not the record itself. ## Common setup mistakes - **Jumping straight to `p=reject`.** Skipping the `none` monitoring phase means any misconfigured sender is silently rejected from day one. Always ramp: none, then quarantine, then reject. - **Missing senders.** Marketing platforms, help desks, invoicing tools and CRMs all send as your domain. If you enforce before they appear in reports, their mail gets blocked. - **A broken SPF record killing alignment.** More than 10 DNS lookups triggers a `permerror` and fails SPF everywhere. Keep the record flat and valid — this is where most DMARC rollouts quietly break. - **Never leaving `p=none`.** Monitoring forever gives you visibility but zero protection. `none` is a starting line, not a destination. ## Frequently Asked Questions ### How do I set up DMARC? First make sure SPF and DKIM pass and align for your domain. Then publish a TXT record at `_dmarc.yourdomain.com` starting at `p=none` with a `rua` reporting address. Monitor the aggregate reports, fix any legitimate senders that fail, and gradually raise the policy to `quarantine` and then `reject`. ### Do I need SPF and DKIM before DMARC? Yes. DMARC has nothing to enforce without them — it only checks whether SPF or DKIM passed and aligned with your visible From domain. Set up and verify both first using the [SPF Checker](/tools/spf-checker/) and your [DKIM](/dkim/) configuration, then publish DMARC on top so it has real authentication results to act on. ### How long does DMARC setup take? The DNS record takes minutes, but reaching safe enforcement takes weeks. Budget two to four weeks at `p=none` to capture every sender, then a few more at `quarantine` with a `pct` ramp before moving to `reject`. Large domains with many third-party senders can take a couple of months. The monitoring, not the record, is the real work. ### What DMARC record should I start with? Start with `v=DMARC1; p=none; rua=mailto:dmarc@example.com` published at `_dmarc.yourdomain.com`. The `p=none` policy enforces nothing and simply asks receivers to send reports to your `rua` address, so no mail is affected while you learn which sources send as your domain. See [the DMARC record](/dmarc/dmarc-record/) for more tags. Rated 5/5 on G2 · Trusted since 2018 ## Trusted by 50,000+ domains ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) ### "Great service and great support" > AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. GF Greg F. Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How do I set up DMARC?","acceptedAnswer":{"@type":"Answer","text":"First make sure SPF and DKIM pass and align for your domain. Then publish a TXT record at `_dmarc.yourdomain.com` starting at `p=none` with a `rua` reporting address. Monitor the aggregate reports, fix any legitimate senders that fail, and gradually raise the policy to `quarantine` and then `reject`."}},{"@type":"Question","name":"Do I need SPF and DKIM before DMARC?","acceptedAnswer":{"@type":"Answer","text":"Yes. DMARC has nothing to enforce without them — it only checks whether SPF or DKIM passed and aligned with your visible From domain. Set up and verify both first using the [SPF Checker](/tools/spf-checker/) and your [DKIM](/dkim/) configuration, then publish DMARC on top so it has real authentication results to act on."}},{"@type":"Question","name":"How long does DMARC setup take?","acceptedAnswer":{"@type":"Answer","text":"The DNS record takes minutes, but reaching safe enforcement takes weeks. Budget two to four weeks at `p=none` to capture every sender, then a few more at `quarantine` with a `pct` ramp before moving to `reject`. Large domains with many third-party senders can take a couple of months. The monitoring, not the record, is the real work."}},{"@type":"Question","name":"What DMARC record should I start with?","acceptedAnswer":{"@type":"Answer","text":"Start with `v=DMARC1; p=none; rua=mailto:dmarc@example.com` published at `_dmarc.yourdomain.com`. The `p=none` policy enforces nothing and simply asks receivers to send reports to your `rua` address, so no mail is affected while you learn which sources send as your domain. See [the DMARC record](/dmarc/dmarc-record/) for more tags."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"DMARC","item":"https://autospf.com/dmarc/"},{"@type":"ListItem","position":3,"name":"Set Up DMARC","item":"https://autospf.com/dmarc/how-to-setup-dmarc/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```