How to set up DMARC, step by step

DMARC builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the domain in the From line. That match is called alignment.

So first make sure every service that sends as your domain has SPF and DKIM set up: your mail host, newsletter tool, CRM, invoicing software, website contact form.

Publish a TXT record at _dmarc on your domain. With p=none, nothing changes for delivery; receivers only send you reports.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

• rua is where the daily aggregate reports go. Use an address you read, or a mailbox set aside for it.
• If the report address is on another domain, that domain must publish an authorisation record, or receivers will not send reports there.
• Publish one DMARC record only.

The reports are XML files listing every server that sent mail as your domain, and whether SPF and DKIM passed. Look for two things:

• Your own services failing: add them to SPF or turn on DKIM signing in them.
• Servers you do not recognise: that is usually someone spoofing your domain, which is exactly what DMARC will stop.

When your own mail passes, move to quarantine. Failing mail then goes to spam. You can start with a percentage to limit the risk.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

Raise pct to 100, wait a couple of weeks, then switch to reject. Fakes are now refused outright.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

• Jumping straight to p=reject before every sending service signs with DKIM. Your own invoices bounce.
• Two DMARC records. Receivers then ignore DMARC completely.
• Forgetting subdomains: sp= sets the policy for them, and it defaults to the main policy.
• Leaving p=none forever. It reports, but it does not protect anything.