How to Set Up DMARC for Email Security

Why DMARC Matters

Email spoofing is trivially easy. Without authentication, an attacker can send an email with your domain in the From header and most recipients will never know the difference. DMARC prevents this by instructing receiving servers to reject or quarantine unauthenticated messages. Beyond security, DMARC improves deliverability — Gmail, Outlook, and Yahoo all favor domains with a published DMARC policy.

Prerequisites: SPF and DKIM

DMARC requires at least one of SPF or DKIM to pass with alignment. In practice, you should have both. SPF verifies the sending server's IP address. DKIM verifies a cryptographic signature in the email header. If you have not set these up yet, start with our SPF guide first.

Step 1: Create Your DMARC Record

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. Here is a minimal starting record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

The key tags explained:

• v=DMARC1 — Version identifier. Must be first.
• p=none|quarantine|reject — The policy. Start with none to monitor.
• rua=mailto: — Where aggregate reports are sent. Essential for visibility.
• ruf=mailto: — Where forensic (failure) reports are sent. Optional but useful.
• pct=100 — Percentage of messages the policy applies to. Default is 100.

Step 2: Start in Monitoring Mode

Setting p=none lets you collect reports without affecting mail delivery. This is critical because you need to discover every legitimate service sending email on your behalf before you start blocking unauthorized senders.

Run in monitoring mode for at least two weeks. During this time, you will receive daily XML reports from major mail providers showing which IPs sent email using your domain and whether SPF and DKIM passed or failed.

Step 3: Analyze Reports

DMARC aggregate reports are XML files. They contain the sending IP, the authentication results, and the volume of messages. Look for legitimate senders that are failing SPF or DKIM — these need to be fixed before tightening the policy. Common culprits include marketing platforms, CRM systems, and transactional email services that were not included in your SPF record.

Step 4: Tighten the Policy

Once all legitimate senders pass authentication, gradually move to a stricter policy:

1. Move to p=quarantine; pct=10 — quarantines 10% of failing messages.
2. Increase pct to 50, then 100 over several weeks.
3. Finally, move to p=reject — the strongest policy. Unauthorized messages are outright rejected.

Understanding Alignment

DMARC checks alignment — the domain in the From header must match (or be a subdomain of) the domain authenticated by SPF or DKIM. There are two alignment modes: relaxed (default, allows subdomains) and strict (exact domain match required). Most organizations should use relaxed alignment.

Common DMARC Mistakes

• Jumping straight to p=reject without monitoring first.
• Not configuring a rua address — you are flying blind.
• Forgetting to set DMARC on subdomains that send email.
• Ignoring third-party services that send on your behalf.