Set up DMARC step by step

Step 1: Understand alignment before you publish

DMARC passes when SPF or DKIM passes AND the domain that passed matches the domain in the visible From: address. SPF checks the envelope sender, which third-party platforms often set to their own domain — SPF passes, but it does not align. That is why DKIM signed with YOUR domain is the dependable route to a DMARC pass.

Step 2: Decide where reports go

Create an address such as dmarc@yourdomain.com. Expect a steady flow of compressed XML files from large receivers. If you send reports to an address on a different domain, that domain must publish a record authorising it, or receivers will not send them.

yourdomain.com._report._dmarc.reportdomain.com.  TXT  "v=DMARC1"

Step 3: Publish the record in monitor mode

Add a TXT record at the host _dmarc. v=DMARC1 must come first, with the policy straight after it. p=none changes nothing about delivery; it only asks for reports. Publish exactly one DMARC record — if receivers find two, they apply neither.

Host:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Step 4: Check that it is live

Query the record directly. If nothing comes back, the host field probably doubled the domain (_dmarc.yourdomain.com.yourdomain.com).

dig +short TXT _dmarc.yourdomain.com

Step 5: Work through the reports

Each aggregate report lists the IP addresses that sent mail as your domain and whether SPF and DKIM passed and aligned. Group them by source. For each legitimate sender that fails, turn on DKIM with your domain at that sender, or add it to SPF. Give it at least two weeks so monthly senders such as invoicing tools show up.

Step 6: Enforce in two stages

Move to p=quarantine, which sends failing mail to spam, and watch the reports for another two weeks. Then move to p=reject. Subdomains inherit the policy unless you set sp= separately.

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com