Skip to content
Back to Blog
DMARC.WS Team··10 min read

How to Set Up DMARC Step by Step

DMARCTutorialDNS

Before You Begin

Before setting up DMARC, make sure you have:

  • SPF configured — A TXT record at your domain listing authorized senders
  • DKIM configured — Your email provider has DKIM signing enabled
  • DNS access — You can add TXT records to your domain's DNS

If you're unsure, use the free SPF Checker and DKIM Checker tools to verify.

Step 1: Start with Monitoring (p=none)

Add this TXT record to your DNS:

Field Value
Name/Host _dmarc
Type TXT
Value v=DMARC1; p=none; rua=mailto:your-id@reports.dmarc.ws

The p=none policy means "don't take action on failing emails, just send me reports." This is critical — it lets you see who's sending email as your domain without disrupting legitimate mail.

Step 2: Monitor Reports for 2-4 Weeks

Once your DMARC record is published, email providers like Google, Microsoft, and Yahoo will start sending you daily aggregate reports.

These reports contain:

  • Every IP address that sent email using your domain
  • Whether SPF and DKIM passed or failed for each source
  • The volume of messages from each sender

Use DMARC.WS to parse and visualize these reports. Look for:

  • Legitimate senders failing SPF/DKIM — fix their configuration
  • Unknown senders — investigate whether they're authorized
  • Spoofing attempts — unauthorized senders impersonating your domain

Step 3: Fix Authentication Issues

Common issues you'll discover in reports:

Third-party services not in SPF

Add include: mechanisms for each service:

v=spf1 include:_spf.google.com include:amazonses.com include:sendgrid.net -all

DKIM not configured for a sending service

Enable DKIM in each email provider's settings:

  • Google Workspace: Admin Console → Apps → Gmail → Authenticate email
  • Microsoft 365: Exchange Admin → DKIM
  • SendGrid / Mailchimp / SES: Follow their DKIM setup guides

Subdomain emails failing alignment

If you send from subdomains (e.g., news.example.com), ensure they have their own SPF/DKIM or use DMARC relaxed alignment (the default).

Step 4: Move to Quarantine

Once your pass rate is above 95% for 2+ weeks, tighten the policy:

v=DMARC1; p=quarantine; rua=mailto:your-id@reports.dmarc.ws; pct=25

The pct=25 tag means only 25% of failing emails will be quarantined. This gives you a safety net. Gradually increase: 25% → 50% → 100%.

Step 5: Enforce with Reject

When you're confident all legitimate email is passing:

v=DMARC1; p=reject; rua=mailto:your-id@reports.dmarc.ws

This tells receiving servers to reject any email that fails DMARC authentication. This is the strongest protection against spoofing.

Common Mistakes to Avoid

  1. Jumping straight to p=reject — Always start with monitoring
  2. Forgetting third-party senders — SaaS tools, CRMs, marketing platforms all send email on your behalf
  3. Ignoring subdomains — Add sp=reject to protect subdomains too
  4. Not monitoring after enforcement — Keep watching reports for new senders
  5. Too many SPF lookups — SPF has a 10-lookup limit; use flattening if needed

Timeline

Week Action DMARC Policy
1 Publish DMARC record p=none
1-4 Monitor reports, fix SPF/DKIM issues p=none
5 Begin quarantine rollout p=quarantine; pct=25
6-7 Increase quarantine percentage p=quarantine; pct=100
8+ Move to reject p=reject