How Do You Set Up a DMARC Record? From p=none to p=reject, Explained
DMARC is what stops criminals sending email that genuinely appears to come from your domain, and inbox providers increasingly expect it. Setting it up is a short DNS job plus a patient few weeks of checking reports. This guide explains each step in plain English, and our free DMARC Record Generator writes the record for you at every stage, so you never have to hand-type the syntax.
What is DMARC, and what does it actually do?
DMARC is a DNS record that tells receiving mail servers three things: check that incoming mail claiming to be from your domain lines up with its SPF or DKIM authentication, here is what to do with mail that fails, and here is an email address where you want the reports sent. It protects the From address your readers see, which neither SPF nor DKIM fully covers on its own.
The alignment idea is the heart of it. A message passes DMARC when the domain in the visible From header matches the domain verified by SPF or the domain in the DKIM signature. A spoofed message sent from a random server fails both, and your published policy then decides its fate: deliver, quarantine or reject.
What do you need in place before DMARC?
Working SPF and DKIM. DMARC passes when at least one of them passes with alignment, so publish your SPF record first, listing every service that sends for you, and switch on DKIM signing inside each of those services. Skipping this groundwork is the main reason DMARC projects stall or break real mail.
If SPF is not done yet, our SPF Record Generator builds it in minutes, and our SPF guide explains the 10 lookup limit that catches people out. Give the new records a few days of normal sending before adding DMARC, so you know the foundation itself is stable.
Step one: how do you start with p=none?
Publish a DMARC record with the policy set to none and an rua address for reports, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, as a TXT record at the host _dmarc. In monitoring mode nothing is blocked or filtered; you simply start receiving daily reports from mailbox providers about everything claiming to be your domain.
Stay here for two to four weeks, long enough for monthly sends such as invoices and newsletters to appear. The reports will name senders you forgot existed. For each legitimate one, fix its SPF or DKIM until it shows as passing with alignment. Only when every real sender passes is it safe to strengthen the policy.
Step two: how do reports tell you it is safe to move on?
Reports are XML files, so read them through a DMARC report tool that turns them into tables. You are looking for two things: every source you recognise passing DMARC, and the failing sources being only the spoofers and forwarders you expect. When a full reporting cycle shows no legitimate failures, your domain is ready for enforcement.
One quirk to expect: mailing list posts and auto-forwarded mail often fail SPF because the forwarder’s server is not in your record, though DKIM usually survives and carries the pass. This is normal background noise in reports, not a reason to stay on monitoring forever.
Step three: how do you move to quarantine safely?
Change the policy to quarantine, starting with a percentage: p=quarantine; pct=25 applies it to a quarter of failing mail, which in practice means some failing messages land in spam while most still arrive. Raise pct through 50 to 100 over one to two weeks, watching reports and your support inbox for any sign of real mail going astray.
The pct dimmer switch is what makes DMARC rollouts low-risk. At every step you can stop, fix a newly discovered sender, and continue. Generate each staged record with our DMARC Record Generator so the syntax stays perfect while only the policy and percentage change.
Step four: when do you switch to p=reject?
When quarantine has run at 100 percent for a week or two with reports showing only illegitimate failures, change the policy to reject. From that moment, spoofed mail using your exact domain is refused during delivery by every enforcing provider, which includes Gmail, Microsoft and Yahoo, and never reaches your customers’ inboxes at all.
Reject is the destination, not the start line. Domains that jump straight to reject without the monitoring stages routinely block their own newsletters or billing mail. Domains that follow the stages almost never have a problem, because by reject day every genuine sender has been observed passing for weeks.
Should you use relaxed or strict alignment?
Relaxed, the default, for almost everyone. Relaxed alignment lets subdomains count as aligned, so mail from news.yourdomain.com aligns with yourdomain.com, which matches how most businesses actually send. Strict alignment requires the domains to match character for character, and mainly suits organisations that deliberately isolate every subdomain.
You set these with the adkim and aspf tags. If a tag is absent, relaxed applies, so a simple finished record often omits both. Change one to strict only if you fully control that authentication path and have watched it in reports; strict SPF in particular breaks easily with third-party senders.
Frequently asked questions
How long does the whole DMARC rollout take?
Four to eight weeks for most small domains: two to four weeks monitoring, a week or two stepping up quarantine, then reject. Rushing it is how legitimate mail gets blocked, so treat the calendar as part of the security.
Do I need DMARC if I only send a little email?
Yes, and arguably more so: a quiet domain is an attractive spoofing target precisely because nobody watches it. Gmail and Yahoo also require DMARC for bulk senders, and having it improves deliverability trust generally.
What is the difference between rua and ruf?
Rua receives daily aggregate summaries of all mail seen for your domain, which are the reports you actually manage a rollout with. Ruf receives individual failure reports in near real time; fewer providers send them, and most domains can skip ruf entirely.
Can DMARC break my website contact form emails?
Only if the form sends as your domain from a server that is not authenticated, and only once you enforce quarantine or reject. The monitoring stage exists to catch exactly this: the form shows up in reports, you authenticate it, and then you proceed.
Email authentication mistakes can disrupt real mail delivery; follow the staged rollout, keep each stage until reports are clean, and ask your email provider’s support team to review your record before switching to p=reject.
