Fix guide

How to set up DMARC, step by step

Publish a safe DMARC record today, then move from monitoring to full protection without blocking your own email.

Before you start

DMARC builds on SPF and DKIM. Make sure both pass first with the SPF checker and DKIM checker, otherwise DMARC will report your own mail as failing.

Set up DMARC in five steps

Choose where reports go. Use a mailbox set aside for them, such as dmarc@yourdomain.com, or a reporting service. Busy domains get several XML reports a day.

Build the record. Start with p=none, which blocks nothing and just sends you reports. The DMARC record generator writes it for you.

Publish it. At your DNS provider, add a TXT record with the name _dmarc and paste the value. Only ever have one DMARC record.

Read the reports for two to four weeks. Look for services sending as you that fail SPF and DKIM. Fix them, or remove them if they shouldn’t be sending.

Tighten the policy. Move to p=quarantine so fake mail goes to spam, then to p=reject so it is refused.

A safe first record

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

This meets the Gmail, Yahoo and Outlook minimum for bulk senders. It doesn’t yet stop anyone faking your domain, which is why steps 4 and 5 matter.

Check it worked

DNS changes usually show within minutes. Look your domain up to confirm the record and see what it means.