How to Set Up DMARC Step by Step
Before You Begin
Before setting up DMARC, make sure you have:
- SPF configured — A TXT record at your domain listing authorized senders
- DKIM configured — Your email provider has DKIM signing enabled
- DNS access — You can add TXT records to your domain's DNS
If you're unsure, use the free SPF Checker and DKIM Checker tools to verify.
Step 1: Start with Monitoring (p=none)
Add this TXT record to your DNS:
| Field | Value |
|---|---|
| Name/Host | _dmarc |
| Type | TXT |
| Value | v=DMARC1; p=none; rua=mailto:your-id@reports.dmarc.ws |
The p=none policy means "don't take action on failing emails, just send me reports." This is critical — it lets you see who's sending email as your domain without disrupting legitimate mail.
Step 2: Monitor Reports for 2-4 Weeks
Once your DMARC record is published, email providers like Google, Microsoft, and Yahoo will start sending you daily aggregate reports.
These reports contain:
- Every IP address that sent email using your domain
- Whether SPF and DKIM passed or failed for each source
- The volume of messages from each sender
Use DMARC.WS to parse and visualize these reports. Look for:
- Legitimate senders failing SPF/DKIM — fix their configuration
- Unknown senders — investigate whether they're authorized
- Spoofing attempts — unauthorized senders impersonating your domain
Step 3: Fix Authentication Issues
Common issues you'll discover in reports:
Third-party services not in SPF
Add include: mechanisms for each service:
v=spf1 include:_spf.google.com include:amazonses.com include:sendgrid.net -all
DKIM not configured for a sending service
Enable DKIM in each email provider's settings:
- Google Workspace: Admin Console → Apps → Gmail → Authenticate email
- Microsoft 365: Exchange Admin → DKIM
- SendGrid / Mailchimp / SES: Follow their DKIM setup guides
Subdomain emails failing alignment
If you send from subdomains (e.g., news.example.com), ensure they have their own SPF/DKIM or use DMARC relaxed alignment (the default).
Step 4: Move to Quarantine
Once your pass rate is above 95% for 2+ weeks, tighten the policy:
v=DMARC1; p=quarantine; rua=mailto:your-id@reports.dmarc.ws; pct=25
The pct=25 tag means only 25% of failing emails will be quarantined. This gives you a safety net. Gradually increase: 25% → 50% → 100%.
Step 5: Enforce with Reject
When you're confident all legitimate email is passing:
v=DMARC1; p=reject; rua=mailto:your-id@reports.dmarc.ws
This tells receiving servers to reject any email that fails DMARC authentication. This is the strongest protection against spoofing.
Common Mistakes to Avoid
- Jumping straight to p=reject — Always start with monitoring
- Forgetting third-party senders — SaaS tools, CRMs, marketing platforms all send email on your behalf
- Ignoring subdomains — Add
sp=rejectto protect subdomains too - Not monitoring after enforcement — Keep watching reports for new senders
- Too many SPF lookups — SPF has a 10-lookup limit; use flattening if needed
Timeline
| Week | Action | DMARC Policy |
|---|---|---|
| 1 | Publish DMARC record | p=none |
| 1-4 | Monitor reports, fix SPF/DKIM issues | p=none |
| 5 | Begin quarantine rollout | p=quarantine; pct=25 |
| 6-7 | Increase quarantine percentage | p=quarantine; pct=100 |
| 8+ | Move to reject | p=reject |