How to set up DMARC, step by step

Three records work together. SPF lists the servers allowed to send mail for your domain. DKIM signs each message so the receiving mailbox can check it really came from you and wasn’t changed. DMARC says what to do when a message fails those checks, and where to send reports about it.

Since February 2024, Google and Yahoo require anyone sending in bulk to their users to have SPF, DKIM and a DMARC record, and Microsoft added similar requirements for Outlook.com in 2025. For everyone else, DMARC is what stops strangers sending invoices as you.

The steps

1. List everything that sends as youYour mailbox provider (Google Workspace or Microsoft 365), your website’s contact form, invoicing and accounting software, your newsletter tool, booking and CRM systems, your phone system’s voicemail-to-email. Most businesses find two or three they’d forgotten.
2. Fix SPFPublish one SPF record (a TXT record starting v=spf1) that includes every legitimate sender, ending in ~all or -all. Only one SPF record is allowed per domain, and it must stay under ten DNS lookups; our SPF lookup guide covers that limit.
3. Turn on DKIM at each senderEach service gives you a DNS record to publish, then you switch signing on in its settings. Google Workspace and Microsoft 365 both need this done by hand.
4. Publish DMARC at p=noneA TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:an address you read. This changes nothing about delivery yet; it just starts the reports.
5. Read the reports for two to four weeksMailbox providers send daily reports of every server that sent mail claiming to be you, and whether it passed. Look for legitimate senders that fail, and fix them. A DMARC report reader makes the XML readable.
6. Move to quarantinep=quarantine sends failing mail to spam. Watch for a week or two for complaints from staff or customers about missing mail.
7. Move to rejectp=reject tells receiving servers to refuse failing mail outright. This is the setting that actually stops forgeries. Keep reading reports when you add a new tool.

Mistakes that leave you exposed

• Stopping at p=none. Many setups stop here. It tells mailboxes to deliver forged mail anyway.
• pct=0 or a low pct. A pct value applies the policy to only that share of failing mail. Our email check flags it.
• Two DMARC records. Mailboxes treat that as no policy.
• Forgetting subdomains and parked domains. A domain you don’t send from should have p=reject and an SPF record of v=spf1 -all.