How to Set Up DMARC, Step by Step (From p=none to p=reject)
Gmail, Yahoo and Outlook now expect DMARC on sending domains. This step-by-step guide takes you from your first p=none record to full p=reject enforcement - reports, alignment fixes and all - without losing legitimate mail.
Run the same check right now — free
Enter your domain and get a 9-point audit — DNS, SPF/DKIM/DMARC, SSL, security headers, dark-web exposure — in 60 seconds.
No signup · <60s · GDPR/EU processing
Anyone can put your domain in the From field of an email. Without DMARC, a scammer can send fake invoices, password resets or CEO-fraud messages that look exactly like they came from you - and many receiving servers will deliver them. DMARC closes that door, and the world's largest mailbox providers have stopped treating it as optional: Gmail and Yahoo have required it for bulk senders since February 2024, and Microsoft began rejecting non-compliant high-volume mail in May 2025.
This guide walks you through the whole setup: your first monitoring record in about 15 minutes, then a safe, staged path to full enforcement. No mail gets lost along the way if you follow the stages in order.
What a DMARC record actually does
DMARC (Domain-based Message Authentication, Reporting and Conformance, defined in RFC 7489) is a TXT record in your DNS that builds on two other standards, SPF and DKIM. It tells every receiving mail server three things:
- How to verify that mail claiming to be from your domain really is - the From domain must align with the domain that passed SPF or DKIM.
- What to do when verification fails - nothing (
p=none), send it to spam (p=quarantine), or refuse it outright (p=reject). - Where to send reports about everything it saw, so you get visibility into every service sending as your domain - legitimate or not.
If you want the concepts in more depth, read our guide What is DMARC and why is it important? - this article is the hands-on rollout.
Before you start: three prerequisites
- Access to your DNS. You will add TXT records at your DNS host (Cloudflare, your registrar, Route 53, etc.).
- A working SPF record. It lists which servers may send mail for your domain. Verify yours with our SPF record guide.
- DKIM enabled in every sending service. Each service cryptographically signs your mail. Google Workspace, Microsoft 365, Mailchimp, HubSpot, Zendesk and most invoicing platforms all have a DKIM or "domain authentication" setting - turn it on everywhere.
Take five minutes to inventory everything that sends email as your domain: mail platform, newsletter tool, CRM, helpdesk, billing system, website contact forms. Every one of them must eventually authenticate, or enforcement will bite you later.
You can check your current state from any terminal:
dig TXT yourdomain.com +short
dig TXT _dmarc.yourdomain.com +short
On Windows, nslookup -type=TXT _dmarc.yourdomain.com does the same job. If the second query returns nothing, you have no DMARC record yet - which is exactly what we are about to fix.
Step 1: Publish a monitoring-only record (p=none)
Create a TXT record with these values at your DNS host:
Host/Name: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
The record lives at _dmarc.yourdomain.com - most DNS panels only ask for the _dmarc part. Three practical notes:
- Use a dedicated mailbox (or alias) for
rua. Aggregate reports arrive daily from every major receiver and will clutter a personal inbox fast. - Publish exactly one DMARC record. Two records at
_dmarcmeans receivers ignore both. p=nonechanges nothing about delivery. It is pure observation mode - the safe starting point for every domain, no matter how messy your email setup is.
DNS propagation usually takes minutes, occasionally a few hours depending on TTL.
The DMARC tags that matter
| Tag | What it does | Recommended |
|---|---|---|
v | Protocol version | DMARC1 (mandatory, must be first) |
p | Policy for your domain | none → quarantine → reject over time |
rua | Where aggregate reports go | mailto: address you actually check |
ruf | Forensic (per-message) reports | Skip it - most receivers no longer send these |
sp | Policy for subdomains | Set sp=reject at the final stage |
adkim | DKIM alignment mode | r (relaxed, default) is right for most |
aspf | SPF alignment mode | r (relaxed, default) is right for most |
pct | % of failing mail the policy applies to | Use for ramping quarantine (25 → 50 → 100) |
fo | Failure-report options | Leave default unless debugging DKIM |
Step 2: Read the reports and fix what fails (2–6 weeks)
Within a day or two, aggregate reports (XML files) start arriving from Gmail, Yahoo, Microsoft and others. Each one lists the IP addresses that sent mail using your domain, how many messages, and whether they passed SPF, DKIM and - crucially - alignment: the From domain matching the domain that actually passed. Relaxed alignment accepts subdomains (mail.yourdomain.com aligns with yourdomain.com); strict requires an exact match.
The typical findings, in order of frequency:
- A newsletter or CRM tool signs with its own domain, not yours. Fix: enable custom-domain DKIM (often called "domain authentication") inside that tool.
- A server or SaaS tool is missing from SPF. Fix: add its include or IP to your SPF record.
- Forwarded mail fails SPF. Expected - forwarding rewrites the sending IP. As long as DKIM survives (it usually does), aligned DKIM keeps the mail passing DMARC.
At low volume you can read the XML by hand; beyond a few reports a day, a report analyzer saves real time. Give this phase two to six weeks - long enough to catch monthly senders like invoicing runs.
Step 3: Tighten to quarantine
Once reports show all legitimate sources passing with alignment for several consecutive weeks, step up:
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.com
Failing mail now lands in spam folders - for 25% of failures. Raise pct to 50, then 100 over a few weeks while watching the reports. One caveat: some receivers apply the policy to all mail regardless of intermediate pct values, so treat the ramp as a convenience, not a guarantee - and don't camp at pct=25 for months.
Step 4: Move to reject and cover subdomains
The destination - spoofed mail is refused outright:
v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@yourdomain.com
sp=reject closes the subdomain loophole (invoices.yourdomain.com, hr.yourdomain.com) that attackers probe next. Two final habits: keep the rua address alive forever - reports are how you notice when a new tool starts sending unauthenticated - and put parked domains that never send mail straight at p=reject with a restrictive SPF (v=spf1 -all). Scammers love forgotten domains.
The deadlines that made DMARC mandatory
| Provider | In force | Applies to | Minimum requirement |
|---|---|---|---|
| Gmail | Feb 2024, rejections since late 2025 | 5,000+ msgs/day to Gmail | SPF + DKIM + DMARC (p=none or stronger), aligned From, one-click unsubscribe, spam rate < 0.3% |
| Yahoo/AOL | Feb 2024 | 5,000+ msgs/day | Same core set: SPF + DKIM + DMARC with alignment |
| Outlook.com / Hotmail / Live | May 5, 2025 - non-compliant mail rejected (error 550 5.7.515) | 5,000+ msgs/day to consumer accounts | SPF + DKIM + DMARC at least p=none, aligned with SPF or DKIM |
Below 5,000 messages a day you escape the letter of these rules, but not their spirit: the same providers still weigh authentication heavily in spam filtering for everyone, and the thresholds have only moved in one direction.
Most domains stop halfway - don't
EasyDMARC's 2026 adoption report, analyzing 1.8 million domains, found 52% now publish a DMARC record (up from 47.7% in 2025) - but 56% of those never move past p=none. Monitoring mode satisfies the mailbox providers' checkbox, yet blocks nothing: a spoofed invoice still lands in your customer's inbox. Meanwhile 95% of the Fortune 500 publish DMARC and more than 80% of them enforce it.
Share of DMARC-enabled domains by policy level, 2026 (source: EasyDMARC adoption report).
Common mistakes
- Two DMARC records at
_dmarc- receivers must ignore both. Merge into one. - A typo in the
ruaaddress - you fly blind for weeks before noticing. - Publishing the record at the root instead of the
_dmarchost - it is simply never found. - Jumping straight to
p=rejectwithout a monitoring phase - the fastest way to lose your own newsletter or invoices. - Forgetting subdomains - without
sp=, subdomains inheritp=, but check that this is what you want at each stage. - Treating
p=noneas done - it proves you exist; it protects nothing.
Frequently asked questions
I send fewer than 5,000 emails a day. Do I still need DMARC? Yes. Spoofing doesn't check your volume - small companies are prime targets for invoice fraud precisely because they lack enforcement. The bulk-sender rules are a floor, not the definition of who benefits.
How long does the whole rollout take?
Typically 4–12 weeks from first record to p=reject, driven mostly by how many sending services you must fix during monitoring. A domain with one mail platform can move in a month.
Will DMARC improve my deliverability? Aligned SPF/DKIM/DMARC is now part of how Gmail, Yahoo and Microsoft score senders, so yes - properly authenticated domains see fewer spam-folder placements. The reverse is also true: broken authentication increasingly means rejection.
What's the practical difference between quarantine and reject?
quarantine delivers failing mail to the spam folder - recipients can still find it. reject refuses it at the door - the strongest protection and the end goal for domains that have cleaned up their senders.
Do I need a paid tool to read the reports? Not at low volume - the XML is human-readable. Once multiple reports arrive daily, a free or paid analyzer pays for itself in time saved.
Check your email authentication in 60 seconds
Not sure where your domain stands right now? Run the free FortifyNet scan - it checks your SPF, DKIM and DMARC records (including policy strength and common syntax errors), plus SSL/TLS, security headers and dark-web exposure. One minute, no signup, and you'll know exactly which step of this guide to start at.
