DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that fail SPF and DKIM authentication.

What DMARC policy should I start with?

Start with p=none to monitor without blocking any email. Once you review reports and confirm legitimate email is passing, move to p=quarantine, then eventually p=reject.

Where is the DMARC record placed?

DMARC is a TXT record placed at _dmarc.yourdomain.com, not at the domain root.

How to Set Up DMARC — Step-by-Step Guide

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do when emails from your domain fail authentication. It builds on SPF and DKIM to give you control and visibility over your email.

SPF checks the sending server, DKIM checks the signature, and DMARC decides what happens when either one fails.

Prerequisites

Before setting up DMARC, you should have:

SPF record configured for your domain
DKIM signing set up with your email provider

DMARC works by checking that at least one of SPF or DKIM aligns with the From: domain.

Step 1: Create a Monitoring DMARC Record

Start with p=none — this monitors without rejecting any email. Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]

This tells receiving servers to send aggregate reports to your email address.

Step 2: Review Reports

After a few days, you'll receive XML reports showing which servers are sending email from your domain and whether they're passing SPF/DKIM. Review these to ensure your legitimate email is authenticating correctly.

Use a DMARC report analyzer (many free options exist) to parse the XML into readable format.

Step 3: Move to Quarantine

Once your legitimate email consistently passes, update to p=quarantine:

v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]

The pct=10 means apply the policy to only 10% of failing email. Gradually increase this to 100% as you gain confidence.

Step 4: Enforce with Reject

The strongest policy — failing emails are rejected outright:

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]

DMARC Record Parameters

Tag	Example	Description
`p`	`p=reject`	Policy: none, quarantine, or reject
`sp`	`sp=quarantine`	Subdomain policy (defaults to p if omitted)
`pct`	`pct=50`	Percentage of mail to apply policy to (1-100)
`rua`	`rua=mailto:[email protected]`	Aggregate report destination
`ruf`	`ruf=mailto:[email protected]`	Forensic (failure) report destination
`adkim`	`adkim=s`	DKIM alignment: s (strict) or r (relaxed)
`aspf`	`aspf=r`	SPF alignment: s (strict) or r (relaxed)

DMARC Alignment Explained

DMARC requires "alignment" — the domain in the email's From: header must match the domain used in SPF or DKIM authentication:

Relaxed (r) — subdomains are allowed (default). mail.example.com aligns with example.com
Strict (s) — exact match required. mail.example.com does NOT align with example.com

Common Mistakes

Jumping straight to p=reject without monitoring first — legitimate email may fail
Placing the record at the domain root instead of _dmarc.yourdomain.com
Not setting up SPF and DKIM first
Forgetting to include rua — without reports you can't monitor what's happening

Check Your DMARC Record

Use the Email Security checker to verify your DMARC is configured correctly:

Check your DMARC →← What is SPF?

Try it on your domain

See the theory in practice — run a Email Security Check for your own domain.