How to Set Up DMARC Step by Step: From p=none to p=reject
A practical DMARC deployment guide: publish the record, read aggregate reports, and safely move from monitoring (p=none) to full enforcement (p=reject).
By the DNSLab team Updated July 9, 2026
Quick answer
DMARC tells receiving servers what to do with email that fails SPF or DKIM checks and sends you reports on how your domain is being used. Set it up by first configuring SPF and DKIM, then publishing a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; to monitor, and tightening the policy to p=quarantine or p=reject once reports confirm your legitimate mail passes.
What DMARC is and what it actually enforces
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receiving mail servers what to do when a message claiming to be from your domain fails authentication. It builds on SPF and DKIM by adding a third requirement: alignment. A message passes DMARC only if SPF or DKIM passes AND the authenticated domain matches the visible From address. Without DMARC, an attacker can pass SPF for their own domain while spoofing yours in the From header. DMARC closes that gap and, through aggregate reports, shows you exactly who is sending mail as your domain.
Prerequisites: SPF and DKIM must work first
DMARC has nothing to enforce until SPF and DKIM are already producing pass results for your legitimate mail. Before touching DMARC, confirm your SPF record lists every service that sends on your behalf (mail server, marketing platform, helpdesk, invoicing tool) and that DKIM signing is enabled with published public keys. Use the dnslab SPF tool to check for syntax errors, too many DNS lookups, or a missing record, and verify each DKIM selector resolves. Deploying DMARC on top of broken SPF or DKIM will silently mark your own mail as failing once you enforce, so fix authentication first.
Publishing your first DMARC record with p=none
Start in monitoring mode. Create a TXT record at _dmarc.yourdomain.com with a value like: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; adkim=r; aspf=r. Here p=none means take no action, only report. The rua address receives daily aggregate reports. adkim=r and aspf=r use relaxed alignment, which allows subdomains to align with the organizational domain. Do not add a percentage or reject action yet. After publishing, wait for DNS propagation and confirm the record resolves with the dnslab DMARC lookup tool, checking that the syntax is valid and the reporting address is accepted.
Reading aggregate reports and finding legitimate senders
Aggregate (rua) reports are XML files from mailbox providers summarizing every source that sent mail using your domain, with SPF and DKIM results plus alignment status. Spend at least two weeks in p=none collecting them. Your goal is a complete inventory: identify every IP and service that sends legitimate mail and make sure each one aligns on SPF or DKIM. You will usually find forgotten senders like a CRM, a status-page tool, or a legacy server. Add missing sources to SPF and enable DKIM for them. Anything that still fails after this cleanup is either misconfigured or unauthorized spoofing.
Stepping up to p=quarantine, then p=reject
Once reports show your real mail consistently aligning, tighten the policy gradually. Move to p=quarantine with a rollout percentage: v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]. Only a quarter of failing mail is quarantined, limiting the blast radius. Watch reports for a week, then raise pct to 50, 100, and finally switch to p=reject. Reject tells receivers to refuse failing mail outright, which is the setting that actually stops spoofing. Do not rush: each step should be backed by clean reports. If a legitimate sender suddenly starts failing, pause and fix it before continuing.
Common mistakes that break DMARC deployments
The biggest error is jumping straight to p=reject before verifying all senders align, which bounces real mail. Others include an SPF record exceeding ten DNS lookups (a permerror that fails alignment), forgetting to DKIM-sign mail from third-party platforms, and publishing two DMARC records where only one is allowed. Forwarding also breaks SPF, so DKIM alignment becomes essential for mailing lists. A missing or unmonitored rua mailbox means you enforce blind. Finally, subdomains inherit the policy unless you set an sp= tag, so test transactional subdomains too before enforcing.
Verifying your setup and monitoring over time
After each change, re-check the record with the dnslab DMARC tool to confirm syntax, policy, and reporting addresses parse correctly. Cross-check SPF with the SPF tool and confirm DKIM selectors resolve. Send test messages to a Gmail and an Outlook account and inspect the Authentication-Results header for dmarc=pass. Keep monitoring aggregate reports even at p=reject, since new services get added over time and can start failing. If your IPs appear in reports as spoofing sources, verify they are not compromised and check the dnslab Blacklist tool to confirm your sending IPs are not listed.
Frequently asked questions
- How long should I stay at p=none before enforcing?
- At least two to four weeks, and longer for domains with many sending services. The point of p=none is to collect enough aggregate reports to build a full inventory of legitimate senders. Only move to quarantine once reports show your real mail consistently aligning on SPF or DKIM with no unexplained failures.
- Do I need both SPF and DKIM for DMARC to pass?
- No. DMARC passes if either SPF or DKIM passes with alignment. However, configuring both is strongly recommended, because forwarding breaks SPF while DKIM survives it. Relying on only one authentication method leaves legitimate mail vulnerable to failing DMARC in common forwarding and mailing-list scenarios.
- What is the difference between p=quarantine and p=reject?
- Quarantine tells receiving servers to accept failing mail but treat it as suspicious, usually delivering it to the spam folder. Reject instructs them to refuse the message entirely, so it never reaches the recipient. Reject is the goal, as it fully stops spoofing, but reach it only after quarantine reports confirm no legitimate mail is affected.