DMARC Setup Guide
Complete guide to setting up DMARC for your domain, from initial deployment to full enforcement.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds on SPF and DKIM. It allows domain owners to specify how receivers should handle emails that fail authentication checks.
DMARC Record Syntax
A DMARC record is a TXT record published at _dmarc.yourdomain.com. Here's an example of a complete DMARC record:
v=DMARC1; p=reject; sp=reject; rua=mailto:your-rua-token@rua.ddmarc.com; ruf=mailto:your-ruf-token@ruf.ddmarc.com; fo=1; adkim=r; aspf=r; pct=100Copy your record from the dashboard, not from this page
The rua and ruf mailboxes above are placeholders. DDMARC generates a unique token per domain and routes incoming reports by reading that token, so the address in your record belongs to your domain alone. Find the real record under Domains → your domain → DNS & Setup. A record copied from an example collects nothing.
The Rotate tokens action on the same page issues fresh tokens and immediately invalidates the old mailboxes — update DNS as soon as you rotate.
Why relaxed alignment (adkim=r / aspf=r)
Relaxed is the DDMARC default and what the setup wizard generates. It lets a subdomain such as mail.example.com satisfy alignment for example.com, which is how most ESPs and transactional senders are set up. Strict alignment (adkim=s; aspf=s) is an optional hardening step — only move to it once your reports show every legitimate source signing with an exact domain match.
| Tag | Required | Description | Example |
|---|---|---|---|
| v | Required | Version (always DMARC1) | v=DMARC1 |
| p | Required | Policy for domain | p=reject |
| sp | Optional | Subdomain policy | sp=quarantine |
| rua | Optional | Aggregate report URI | rua=mailto:dmarc@example.com |
| ruf | Optional | Forensic report URI | ruf=mailto:forensic@example.com |
| np | Optional | Policy for subdomains that do not exist | np=reject |
| t | Optional | Test mode: y applies one level below p | t=y |
| adkim | Optional | DKIM alignment mode (r=relaxed, s=strict) | adkim=r |
| aspf | Optional | SPF alignment mode (r=relaxed, s=strict) | aspf=r |
| fo | Optional | Failure reporting options | fo=1 |
RFC 9989 (2026) replaced the original specification and removed the pct, rf and ri tags. Receivers that still follow RFC 7489 may honor pct=0 or pct=100; other values were applied inconsistently, which is why t=y test mode replaced them.
DMARC Policies
The policy tag (p=) tells receivers what to do with emails that fail DMARC:
p=none—Monitor OnlyTake no action, just collect reports. Use this to start monitoring without affecting delivery.
p=quarantine—QuarantineMark failing emails as suspicious (usually sent to spam folder). Intermediate step before full enforcement.
p=reject—RejectReject failing emails outright. Maximum protection - unauthorized emails won't be delivered.
Recommended Deployment Path
We recommend a phased approach to DMARC deployment. This minimizes risk while you identify and configure all your legitimate email sources.
Monitor
2-4 weeks
p=noneDeploy DMARC in monitoring mode to collect data without affecting email delivery.
Checklist:
- Add the domain in DDMARC — this mints the RUA/RUF tokens your record needs
- Publish the generated DMARC record with p=none
- Identify all legitimate sending sources
- Document third-party email services
Analyze & Fix
2-4 weeks
p=noneReview reports, configure SPF/DKIM for all senders, and fix alignment issues.
Checklist:
- Review aggregate reports in DDMARC
- Add SPF records for all legitimate senders
- Enable DKIM signing on all email sources
- Fix any alignment issues found in reports
Quarantine
2-4 weeks
p=quarantineStart filtering suspicious emails while monitoring for false positives.
Checklist:
- Update policy to p=quarantine
- Add t=y first, so receivers treat quarantine as none while you watch the reports
- Monitor quarantine rates and investigate failures
- Review forensic reports for issues
Enforce
Ongoing
p=rejectFull enforcement. Unauthorized emails are rejected completely.
Checklist:
- Upgrade to p=reject
- Remove t=y once reports show no legitimate failures
- Configure MTA-STS for transport security
- Enable BIMI for brand recognition
Prefer not to run this yourself?
The Enforcement sprint takes a domain from none to reject in about 30 days, up to 60 for a complex estate, third-party senders included ($2,500 per domain, one-time). For ongoing coverage, Managed DMARC gives you a named specialist, a monthly review and a written report ($99 per domain per month, billed annually).
Talk to usAutomate this path with Policy Rollouts
Instead of editing DNS by hand at each phase, let DDMARC drive the progression for you from the domain's Policy tab. Pick a template and the rollout advances on schedule, with safety gates that pause it if your pass rate drops or report volume is too thin to judge.
Included from Professional ($99/mo).Start a 14-day trial →See the Professional plan →
- Standard — the conservative none → quarantine → reject path above
- Gradual — steps the percentage through pct=10, pct=50, pct=100 before moving policy
- Fast — for domains whose senders are already fully authenticated
On the same tier, DDMARC can host the DMARC record itself: point _dmarc.example.com at example.com.dmarc.ddmarc.com with a CNAME once, and every later policy change publishes without another DNS edit.
Common Issues
- Third-party senders: Marketing platforms, CRMs, and other services need SPF/DKIM configured
- Email forwarding: Forwarded emails may break SPF — ARC preserves the original authentication result. DDMARC monitors ARC chains from Growth upward.
- Subdomain policy: Don't forget to set
sp=for subdomains