How to Set Up a DMARC Record (Step-by-Step Guide)

If you've set up SPF and DKIM and now someone says "you need DMARC too," this is the guide for you. Setting up a DMARC record tells receiving mail servers what to do with messages that fail SPF or DKIM — and it's the piece that actually stops domain spoofing.

Here's exactly how to create, publish, and test your DMARC record, step by step.

What you need before you start

DMARC builds on SPF and DKIM. Before publishing a DMARC record, confirm both of these are working:

• SPF record — a TXT record at your domain listing the servers allowed to send mail for you. If you don't have one yet, see the SPF setup guide.
• DKIM record — a public key published in your DNS that lets receivers verify email signatures. If that's missing, see the DKIM setup guide.

Without both in place, DMARC has nothing to check against — every message would fail, and your policy would apply to all your own email.

Step 1: Choose your DMARC policy

Your DMARC record has one required tag: the policy (p=), which tells receivers what to do with messages that fail authentication. There are three options:

Start at p=none. Every DMARC rollout should begin in monitoring mode. You need to see what's sending mail as your domain before you enforce anything. The DMARC policy explained article covers why going straight to reject breaks things.

Step 2: Add a reporting address

The rua= tag tells DMARC where to send aggregate reports — XML files showing every source of email claiming to be from your domain and whether it passed or failed authentication.

rua=mailto:dmarc-reports@yourdomain.com

You'll need a mailbox that can receive these. If you don't want to create a dedicated address, many free DMARC report analyzers provide a reporting address you can use instead.

Without rua=, you're flying blind — you'll never see which legitimate services are failing authentication until you enforce and they break.

Step 3: Build your DMARC record

A basic DMARC record in monitoring mode looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Once you've reviewed your reports and fixed any legitimate senders, you can move to quarantine and eventually reject:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com

Optional tags you may need

• pct= — applies your policy to a percentage of failing mail. pct=25 quarantines 25% of failures, useful when testing enforcement. Default is 100.
• sp= — sets a separate policy for subdomains. p=reject; sp=none protects your root domain while leaving subdomains in monitoring.
• aspf=r and adkim=r — relaxed alignment (the default). Leave these alone unless you have a specific reason for strict alignment.

What the record looks like all together

For a domain starting the DMARC journey:

v=DMARC1; p=none; pct=100; rua=mailto:dmarc-reports@yourdomain.com

For a domain ready for full enforcement:

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com

Step 4: Publish the record in your DNS

DMARC records live at a special hostname: _dmarc.yourdomain.com. Here's how to add it at common DNS providers:

GoDaddy: DNS → Add Record → TXT → Host: _dmarc → Value: your DMARC string → TTL: 3600

Cloudflare: DNS → Add Record → Type: TXT → Name: _dmarc → Value: your DMARC string → TTL: Auto

Google Domains: DNS → Manage Custom Records → Type: TXT → Host: _dmarc → Data: your DMARC string

Namecheap: Advanced DNS → Add New Record → Type: TXT → Host: _dmarc → Value: your DMARC string

AWS Route 53: Create Record → Type: TXT → Name: _dmarc → Value: your DMARC string in quotes → TTL: 300

Important: The _dmarc prefix is required — do not put the full record at the bare domain. Some providers auto-append the domain; with those, entering just _dmarc as the host name is correct.

Step 5: Verify your record is live

DNS changes propagate quickly (typically under a minute with modern providers, but TTL-dependent). Once you've added the record, verify it:

dig TXT _dmarc.yourdomain.com +short

Or use a web-based DMARC lookup — the Email Security Grade scanner checks DMARC, SPF, DKIM, and MX in one request.

A valid response looks like:

"v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

No result means the record isn't published yet — double-check the hostname and wait a few minutes.

Step 6: Monitor reports and iterate

Once your DMARC record is live, receivers will send aggregate reports to the rua= address. These arrive as XML files (typically one per sending source per day) and show:

• Which IPs are sending mail claiming to be from your domain
• Whether each message passed SPF, DKIM, or both
• The disposition applied (none, quarantine, or reject)

A note on false positives with forwarded mail

DMARC has a well-known blind spot: forwarded email. When an email is forwarded, SPF breaks because the forwarding server isn't an authorized sender. DKIM typically survives forwarding if the signature was on the original content. This is why both SPF and DKIM are needed — DKIM covers the case where SPF doesn't.

If you see SPF failures in your reports but DKIM passes, and the source looks like a forwarding service (Google Groups, mailing lists), that's normal. ARC (Authenticated Received Chain) was designed to solve this, but it isn't widely adopted yet.

Step 7: Progress toward enforcement

The standard timeline looks like this:

1. Weeks 1-4: p=none — collect data. Identify every legitimate sender.
2. Weeks 5-6: Fix any legitimate senders that are failing authentication.
3. Weeks 7-8: p=quarantine — test enforcement. Start at pct=25 if you're cautious.
4. Week 9+: p=reject — full protection.

The exact timeline depends on how many services send email for your domain. A simple domain with one mail provider can progress in a week. A complex one with marketing platforms, CRMs, and booking systems takes months. Both are normal.

One common mistake to avoid

Publishing a DMARC record without SPF or DKIM. A DMARC record with p=reject and no SPF or DKIM will reject every message — including your own. Always confirm both are working before you add DMARC enforcement.

Quick reference: DMARC record syntax

v=DMARC1                    (required — version identifier)
p=none|quarantine|reject    (required — policy)
rua=mailto:address          (strongly recommended — reporting)
pct=1-100                   (optional — policy application rate, default 100)
sp=none|quarantine|reject   (optional — subdomain policy)
aspf=r|s                    (optional — SPF alignment, default relaxed)
adkim=r|s                   (optional — DKIM alignment, default relaxed)

Where to check your current setup

Not sure if you already have a DMARC record? Run a free domain scan. It checks DMARC, SPF, DKIM, and MX records in seconds and tells you exactly what's configured and what's missing.