How to set up DMARC

Before enforcing DMARC, confirm that your domain has working SPF and DKIM for the services that send mail. DMARC depends on at least one aligned authentication result, so missing SPF or DKIM coverage creates avoidable failures.

For most domains, the safest first record uses p=none and a rua address for aggregate reports. That gives you reporting without changing delivery decisions for real recipients.

DMARC is published as a TXT record at _dmarc.yourdomain.com. A starter record might include v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100.

Use an inbox or monitoring service that can parse XML aggregate reports. Raw reports are useful, but they become hard to interpret quickly once multiple senders and mailbox providers are involved.

After reports show that legitimate sources pass alignment, change the policy in stages. Move from p=none to p=quarantine, watch for unexpected failures, then move to p=reject when the domain is ready.

Keep monitoring after enforcement. New vendors, marketing tools, and transactional email systems can introduce fresh authentication gaps that were not present during the original rollout.