At a glance. Record host: _dmarc.yourdomain.com (TXT) · Start with: p=none plus a rua address · Move up: quarantine, then reject, in stages · One record: Two records invalidate both
The short version
- What DMARC does. DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
- Before you start. DMARC passes when either SPF or DKIM passes and the domain that passed matches, or aligns with, the domain in the From address.
- Step 1: publish a record in monitoring mode. DMARC is a TXT record at _dmarc.yourdomain.com.
- Step 2: read the aggregate reports. Receivers send daily XML reports to the rua address.
- A worked example of reading a report. Imagine a report shows three sources for your domain.
- DMARC with common mailbox providers. If your staff mail runs on Google Workspace or Microsoft 365, each provider has its own steps for turning on DKIM signing for your domain and its own SPF include value.
What DMARC does
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It builds on two older checks. SPF says which servers may send for your domain, and DKIM adds a signature that proves the message was not altered. DMARC adds two things: a rule for what receivers should do when both checks fail to line up with your visible From domain, and a way for receivers to report back to you.
Without DMARC, anyone can put your domain in the From line and receivers have no instruction from you about what to do. With it, you can see misuse, and when you are ready, ask receivers to reject it.
Before you start
DMARC passes when either SPF or DKIM passes and the domain that passed matches, or aligns with, the domain in the From address. So SPF and DKIM must already be working for every service that sends as your domain: your sending service, your office mailbox provider, your CRM, your support desk and any invoicing tool.
Make a list of every one. Forgotten senders are the single most common reason a DMARC rollout breaks legitimate mail. Our free checker shows what is published today.
Step 1: publish a record in monitoring mode
DMARC is a TXT record at _dmarc.yourdomain.com. Start with the policy p=none, which asks receivers to take no action but still send you reports. Replace the address with a mailbox you actually read, or a reporting service.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comSome DNS panels add the domain name for you, so you only enter _dmarc as the host. Others need the full name. If your panel strips quotes or splits long values, check the result with a lookup tool rather than trusting the screen.
Step 2: read the aggregate reports
Receivers send daily XML reports to the rua address. Each lists the IP addresses that sent mail claiming to be your domain, how many messages, and whether SPF and DKIM passed and aligned. Raw XML is hard to read, so most teams use a free or paid report viewer.
Look for two things. Legitimate senders that fail alignment, which you need to fix, and sources you do not recognise, which may be spoofing. Give it two to four weeks so that monthly senders, such as billing runs, appear too.
A worked example of reading a report
Imagine a report shows three sources for your domain. The first is your sending service: 40,000 messages, SPF and DKIM both pass and align. The second is your office mailbox provider: 600 messages, DKIM passes and aligns. The third is an unfamiliar server in another country: 900 messages, both fail.
The first two need no action. The third is either a tool you forgot or someone pretending to be you. Find out which before you tighten the policy. If it is a forgotten tool, fix its authentication. If it is not yours, that is exactly the traffic p=reject is meant to stop.
DMARC with common mailbox providers
If your staff mail runs on Google Workspace or Microsoft 365, each provider has its own steps for turning on DKIM signing for your domain and its own SPF include value. Do those first, then publish DMARC. Many small businesses in India manage DNS through a registrar panel such as GoDaddy, BigRock or Hostinger, or through Cloudflare, and the TXT record works the same way in each.
Whichever you use, add the DMARC record only once, and verify it with a lookup after a few minutes. DNS changes can take time to spread, and some panels cache for hours.
Step 3: fix what fails
For each legitimate sender that fails, decide whether to fix SPF, DKIM or both. A third-party tool that sends from its own domain needs a custom DKIM signature for yours. A forgotten server needs adding to SPF, keeping within the ten DNS lookup limit.
Forwarded mail can fail SPF because the forwarder's server is not in your record. DKIM usually survives forwarding, which is a good reason to make sure every sender signs.
Step 4: move to quarantine, then reject
When the reports show your legitimate mail passing, tighten the policy in stages. p=quarantine asks receivers to treat failures as suspicious, usually spam. p=reject asks them to refuse the message. The pct tag lets you apply the policy to a share of mail first.
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.comMove one step at a time and watch the reports for a couple of weeks at each stage. There is no prize for reaching reject quickly, and a rushed change can block invoices and password resets.
Subdomains and other tags
A DMARC record applies to subdomains too unless you add an sp tag. If you send marketing mail from a subdomain, you can publish a separate record there. The adkim and aspf tags control alignment strictness. Relaxed, which is the default, lets a subdomain match the organisational domain. Most senders should leave both alone.
You may see a ruf tag for forensic reports. Few receivers send them, and they can contain message content, so most organisations do not use them.
Mistakes to avoid
Publishing two DMARC records on one domain makes both invalid, so keep exactly one. Do not jump to p=reject on day one. Do not point reports at a mailbox nobody reads. And do not treat DMARC as a deliverability fix on its own: it proves who you are, not that your mail is wanted. List quality and complaint rates still decide whether you reach the inbox.
Large mailbox providers now expect bulk senders to have SPF, DKIM and DMARC in place, so it is worth doing even if your volume is modest. Our guide on mailbox provider requirements explains what each one asks for.
Further reading and sources
- RFC 7489: DMARC
- RFC 7208: Sender Policy Framework (SPF)
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- Google: Email sender guidelines
- Yahoo: Sender best practices
Related guides and tools
- DMARC record generator: Build a record you can paste into DNS.
- Check SPF, DKIM and DMARC: Test your domain's records.
- Mailbox provider requirements: What Gmail, Outlook and Yahoo expect.
Not sure your records are right? Run our free checker, or send us a header and we will help you read it.
Frequently asked questions
What does DMARC do?
DMARC lets a domain owner tell receiving servers what to do with mail that fails SPF and DKIM alignment, and asks them to send reports about it. It protects your domain from being used in forged From addresses.
Should I start with p=none?
Yes. A p=none policy takes no action on failing mail but collects reports, so you can find every legitimate sender and fix it before moving to quarantine and then reject.
Can I have two DMARC records?
No. Publish exactly one DMARC TXT record at _dmarc.yourdomain. Two records make the policy invalid, and receivers may ignore both.
How long until I can move to reject?
It depends on how many systems send as your domain. Many teams spend several weeks reading reports and fixing senders before they move up, and they do it in stages rather than in one step.