Reference

How to set up DMARC: from your first record to p=reject

Set up DMARC step by step: SPF and DKIM first, a p=none record with reports, then quarantine and reject once your real senders pass.

By Updated Last verified

On this page
  1. Before you start: SPF and DKIM
  2. Step 1: Choose where reports go
  3. Step 2: Publish a p=none record
  4. Step 3: Read the reports and fix your senders
  5. Step 4: Move to quarantine
  6. Step 5: Move to reject
  7. Setup guides by provider
  8. Check your record
  9. Sources

To set up DMARC, turn on SPF, DKIM or both first (opens in a new tab), then publish a TXT record at _dmarc.example.com with a policy of p=none and a rua address for reports. RFC 9989 (opens in a new tab) describes that as the usual starting point. Read the reports until your legitimate mail passes, then move to quarantine and finally reject.

Before you start: SPF and DKIM

Google's DMARC setup guide (opens in a new tab) requires SPF and/or DKIM for your domain before you use DMARC, and recommends allowing 48 hours after setting them up before you add DMARC. To write an SPF record, use the SPF record generator. For the exact steps in each email service, see the provider guides below.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

Step 1: Choose where reports go

The rua tag lists the addresses that aggregate reports (opens in a new tab) are to be sent to. Without it, receivers must not send you aggregate reports.

Google (opens in a new tab) recommends a group or a dedicated mailbox for DMARC reports. If the address is on a different domain, that domain must publish its own DNS record. The DMARC record generator explains that the other domain must publish a TXT record authorizing it; without it, receivers do not send the reports. Reporting services set this up for you.

Step 2: Publish a p=none record

A DMARC record is a TXT record (opens in a new tab) at the name made by putting _dmarc in front of your domain. Start with a policy of none and your report address. This is the record the DMARC record generator builds for monitoring:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Add it at your domain registrar or DNS hosting service, as Microsoft's DMARC guide (opens in a new tab) describes:

Field Value
Type TXT
Host _dmarc (full name _dmarc.example.com)
Value v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Google (opens in a new tab) notes that some domain hosts add the domain name automatically, so check the record's name after saving, and repeat these steps for each domain. The DMARC record for a domain also covers all its subdomains that do not have their own DMARC record, including nonexistent ones, but each subdomain still needs its own SPF and DKIM.

A p=none policy does not change delivery: RFC 9989 (opens in a new tab) says it must not modify how receivers already handle your mail. For every tag, see DMARC record tags.

Step 3: Read the reports and fix your senders

Aggregate reports (opens in a new tab) show the sources of mail that use your domain. Every legitimate source that fails authentication or alignment must be fixed (opens in a new tab) before you publish an enforcing policy. Depending on how often you send, it can take many months (opens in a new tab) of reports before you are sure all your mail is authenticated.

Not every receiver sends reports; resource limits, local policy and privacy (opens in a new tab) are the most common reasons not to. To read a report, see DMARC reports or use the DMARC report analyzer. If mail fails along the way, see DMARC fail.

Step 4: Move to quarantine

When your reports show your legitimate senders pass, change the policy to quarantine:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

With quarantine (opens in a new tab), the domain owner considers failing mail suspicious. What happens to it depends on the receiving system (opens in a new tab): it might be quarantined as spam, delivered to the Junk Email folder, or delivered to the Inbox with an identifier added to the subject or body.

Step 5: Move to reject

With reject (opens in a new tab), the domain owner considers failing mail a clear sign that the use of the domain is not valid:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

RFC 9989 (opens in a new tab) adds these cautions before you publish it:

  • If your users post to mailing lists, reject is not recommended. Domains that host such users should not publish p=reject. A domain that still wants it should first publish p=none for at least a month, then p=quarantine for an equally long period, comparing the results, and should keep its users off Internet mailing lists or tell them their participation may be hindered.
  • p=reject can cause problems for indirect mail flows such as forwarders, role aliases and mailing lists. Mail relayed that way will most likely fail SPF, while DKIM signatures generally remain valid.
  • A domain at p=reject must not rely on SPF alone for a DMARC pass and must sign its mail with DKIM.

Receivers still decide: final handling is local policy (opens in a new tab), and a receiver may accept failing mail even at reject. If your checker warns that the policy is not enabled, see DMARC policy not enabled; if no record is found, see no DMARC record found.

Setup guides by provider

Check your record

The check reads the public DNS records of the domain you enter and needs no account. It flags a missing DMARC record, a policy of none, no reporting address and subdomains left at none.

Sources

Tools for this

Frequently asked questions

How long should I stay at p=none?

Until your aggregate reports show your legitimate mail passes, which can take many months. Domains whose users post to mailing lists should not publish p=reject at all; if they do, RFC 9989 asks for at least a month at p=none and an equally long period at quarantine first.

Does a DMARC record cover my subdomains?

Yes. The record for a domain covers all its subdomains that do not have their own DMARC record, including nonexistent ones.

Does p=none change how my mail is delivered?

No. A p=none policy must not change how receivers already handle your mail.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account