How to Set Up DMARC

This guide is part of our complete guide to DMARC. Related: the DMARC record and the DMARC policy.

To set up DMARC, first get SPF and DKIM passing and aligned for your domain. Then publish a DMARC TXT record at _dmarc.yourdomain.com starting at p=none with a rua reporting address. Monitor the aggregate reports for a few weeks, fix any legitimate senders that fail alignment, and only then raise the policy to quarantine and finally reject.

DMARC ties SPF and DKIM together and tells receivers what to do when a message fails authentication. Rushed the wrong way, it silently drops real mail. Done in the right order, it locks down your domain against spoofing without hurting deliverability. Here is the practical, step-by-step path.

Prerequisites: SPF and DKIM first

DMARC has nothing to enforce on its own. It only checks whether SPF or DKIM passed and aligned with the domain in the visible From address. If neither is set up, DMARC does nothing useful, so start there.

• Confirm your SPF record exists and lists every service that sends on your behalf. Use the SPF Checker to inspect it, and follow the SPF setup guide if you need to build or fix it.
• Set up DKIM signing for each sending platform so messages carry a valid cryptographic signature that aligns with your domain.
• Keep SPF under the 10-lookup limit. Too many include: mechanisms cause a permerror, which fails SPF and breaks alignment — the single most common reason DMARC blocks legitimate mail. AutoSPF flattens your record automatically so you stay under the limit as you add senders.

Once SPF and DKIM both pass and align, DMARC has something real to enforce.

Step-by-step

1. Confirm SPF and DKIM pass and align. Send test mail to yourself or a seed address and check the headers. Both mechanisms should authenticate, and at least one should align with your From domain.
2. Publish a starter DMARC record. Add a TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none; rua=mailto:dmarc@example.com. p=none enforces nothing yet — it only asks receivers to report. See the DMARC record for every tag you can add.
3. Collect and read aggregate reports. The rua address receives daily XML reports from receivers listing which sources sent as your domain and whether they passed. A report viewer makes these readable.
4. Fix any legitimate senders failing alignment. For each real service that fails, add it to SPF, enable DKIM for it, or correct the sending domain — until every genuine source authenticates and aligns.
5. Raise to p=quarantine. Once your reports are clean, move to p=quarantine. Ramp gradually with the pct tag (for example pct=25, then 50, then 100) so failing mail lands in spam rather than being lost while you watch for surprises.
6. Move to p=reject. When quarantine shows no legitimate failures, set p=reject. Receivers now block spoofed mail outright. This is full enforcement — read the DMARC policy to understand exactly what each policy value does.
7. Verify your record. Confirm the published record and syntax with the DMARC checker after every change.

How long it takes

Publishing the record takes minutes; getting safely to reject takes weeks. Plan on two to four weeks at p=none just to see a full picture of your senders — many services send only occasionally, so a short window misses them. Spend another few weeks at quarantine with a pct ramp before enforcing reject. Large organisations with many third-party senders often take a couple of months. The monitoring is the work; the DNS changes are trivial. Rushing the timeline is what causes lost mail, not the record itself.

Common setup mistakes

• Jumping straight to p=reject. Skipping the none monitoring phase means any misconfigured sender is silently rejected from day one. Always ramp: none, then quarantine, then reject.
• Missing senders. Marketing platforms, help desks, invoicing tools and CRMs all send as your domain. If you enforce before they appear in reports, their mail gets blocked.
• A broken SPF record killing alignment. More than 10 DNS lookups triggers a permerror and fails SPF everywhere. Keep the record flat and valid — this is where most DMARC rollouts quietly break.
• Never leaving p=none. Monitoring forever gives you visibility but zero protection. none is a starting line, not a destination.

Frequently Asked Questions

How do I set up DMARC?

First make sure SPF and DKIM pass and align for your domain. Then publish a TXT record at _dmarc.yourdomain.com starting at p=none with a rua reporting address. Monitor the aggregate reports, fix any legitimate senders that fail, and gradually raise the policy to quarantine and then reject.

Do I need SPF and DKIM before DMARC?

Yes. DMARC has nothing to enforce without them — it only checks whether SPF or DKIM passed and aligned with your visible From domain. Set up and verify both first using the SPF Checker and your DKIM configuration, then publish DMARC on top so it has real authentication results to act on.

How long does DMARC setup take?

The DNS record takes minutes, but reaching safe enforcement takes weeks. Budget two to four weeks at p=none to capture every sender, then a few more at quarantine with a pct ramp before moving to reject. Large domains with many third-party senders can take a couple of months. The monitoring, not the record, is the real work.

What DMARC record should I start with?

Start with v=DMARC1; p=none; rua=mailto:dmarc@example.com published at _dmarc.yourdomain.com. The p=none policy enforces nothing and simply asks receivers to send reports to your rua address, so no mail is affected while you learn which sources send as your domain. See the DMARC record for more tags.