DMARC Setup Guide: How to Add a DMARC Record in 5 Minutes

If your domain doesn't have a DMARC record, attackers can send phishing emails that appear to come from your domain — and receiving servers have no instructions for handling them. Since 2024, Gmail and Yahoo require DMARC for bulk senders.

Publishing even a minimal DMARC record (p=none) gets you into the DMARC ecosystem and starts generating reports you can use to understand your email ecosystem.

# Starter: monitor only (safe starting point)
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

# Light enforcement: quarantine with full reporting
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com; ruf=mailto:forensic@yourdomain.com; fo=1

# Full enforcement: reject with all options
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

1. 1

   Publish p=none with rua= reporting

   Start monitoring-only. Add v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com as a TXT record at _dmarc.yourdomain.com. This starts generating aggregate reports with zero enforcement risk.

2. 2

   Review reports for 2-4 weeks

   Use a DMARC report processor (dmarcian, Valimail, EasyDMARC, or Google Postmaster Tools) to analyze who is sending email as your domain. Identify all legitimate sources.

3. 3

   Configure SPF and DKIM for all senders

   Ensure every service that sends email on your behalf has DKIM signing enabled and is included in your SPF record. DMARC alignment requires at least one to pass.

4. 4

   Move to p=quarantine at pct=10

   Once legitimate senders are fully authenticated, apply quarantine to 10% of failing messages. Monitor for any unexpected failures that indicate misconfigured legitimate services.

5. 5

   Ramp to p=quarantine pct=100

   Increase pct gradually: 10 → 25 → 50 → 100. Watch for legitimate email hitting quarantine at each stage. Fix authentication for any legitimate senders that fail.

6. 6

   Achieve p=reject

   Once p=quarantine pct=100 shows no legitimate failures for 2+ weeks, switch to p=reject. This is the gold standard — spoofed email is blocked entirely at the receiving server.

A basic starter DMARC record: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

This says: monitor only (no enforcement), send aggregate reports to dmarc@yourdomain.com.

Replace dmarc@yourdomain.com with an email address you control and will actively monitor. This address will receive XML report files from Gmail, Outlook, Yahoo, and others.

For monitoring only while you set up authentication: use p=none For protecting the domain with light enforcement: use p=quarantine For maximum protection (only if fully configured): use p=reject

Add a TXT record to your DNS: - Name/Host: _dmarc (creates the record at _dmarc.yourdomain.com) - Type: TXT - Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com - TTL: 3600

That's it. Wait 1-48 hours for DNS propagation.

pct=: Percentage of messages the policy applies to (1-100). Default 100. Use lower values for gradual rollout. ruf=: Address for forensic/failure reports. Optional. ruf=mailto:forensic@yourdomain.com sp=: Subdomain policy. If not set, subdomains inherit the main policy. adkim=: DKIM alignment mode. r (relaxed, default) or s (strict). aspf=: SPF alignment mode. r (relaxed, default) or s (strict). fo=: Failure reporting options. fo=1 sends reports on any authentication failure.

For most domains, the basic v=DMARC1; p=none; rua= record is the right starting point.