To set up DMARC, add one TXT record to your domain’s DNS with the name _dmarc and a value like v=DMARC1; p=none; rua=mailto:[email protected]. Start with p=none, which only collects reports, then move to p=quarantine and p=reject once the reports show all your real mail passes. You need SPF and DKIM working first. Our free DMARC record generator writes the record for you, and the email deliverability checker confirms it is live.
What DMARC does, in one paragraph
SPF says which servers may send mail for your domain, and DKIM signs each message. DMARC ties them to the address people actually see in the From line, and tells receiving inboxes what to do when a message claims to be from you but fails: deliver it anyway (none), put it in spam (quarantine) or refuse it (reject). It also asks them to send you daily reports, so you can see who is sending as your domain. A message passes DMARC when SPF or DKIM passes and the domain it checked matches the From domain, which is called alignment.
Do you need DMARC?
Yes, if your domain sends any email. Since 2024, Gmail and Yahoo require a DMARC record from anyone sending 5,000 or more messages a day to their users, and Microsoft applies the same rule to Outlook.com, Hotmail and Live addresses. p=none is enough to meet that rule. Smaller senders aren’t strictly required to publish one yet, but mail from a domain with no DMARC record is more likely to land in spam, and anyone can spoof your domain in phishing emails. Our page on Gmail, Yahoo and Microsoft sender rules lists every requirement.
The DMARC record, tag by tag
| Tag | Example | What it means |
|---|---|---|
v | v=DMARC1 | Version. Must come first, exactly like this. |
p | p=none | Policy for mail that fails: none, quarantine or reject. Required. |
rua | rua=mailto:[email protected] | Where daily summary (aggregate) reports go. Strongly recommended. |
pct | pct=25 | Share of failing mail the policy applies to, for a gradual rollout. Default 100. |
sp | sp=reject | Policy for subdomains. Default: the same as p. |
adkim / aspf | adkim=s | Alignment: r (relaxed, the default) lets mail.yourdomain.com match yourdomain.com; s (strict) needs an exact match. |
ruf / fo | fo=1 | Per-message failure reports. Few providers send them; most people leave these out. |
Tags are separated by semicolons. The record is defined in RFC 7489.
How to set up DMARC in 5 steps
- Check SPF and DKIM first. Run your domain through the deliverability checker. If SPF is missing, build one with the SPF record generator; turn on DKIM in your email provider’s admin (Google Workspace, Microsoft 365 and most newsletter tools have a switch for it). Google recommends doing this at least 48 hours before DMARC.
- Make a mailbox for reports, such as
[email protected]. Reports are small XML files, sent daily by each big provider. - Write the record. In the DMARC generator, choose none, add your report address and copy the result. For most domains it looks like this:
v=DMARC1; p=none; rua=mailto:[email protected] - Add it to your DNS. Sign in where your domain’s DNS is managed (often the registrar, or Cloudflare). Add a TXT record with the host or name
_dmarcand the record as the value. Some panels want the full name,_dmarc.yourdomain.com; if the panel adds your domain itself, type only_dmarc, or you end up with_dmarc.yourdomain.com.yourdomain.com. - Check it’s live. DNS changes usually show within minutes, sometimes a few hours. Run the email checker again; it reads the DMARC record and points out mistakes.
Only one DMARC record is allowed per domain. If you already have one, edit it rather than adding a second, or inboxes will ignore both.
Moving from p=none to p=reject safely
p=none protects nothing; it only reports. The point is to reach quarantine or reject without blocking your own invoices, newsletters or helpdesk mail. Google’s recommended DMARC rollout is a good plan:
| Stage | Record | Move on when |
|---|---|---|
| 1. Monitor | p=none; rua=… | At least a week of reports show every service that sends for you passing SPF or DKIM with alignment |
| 2. Quarantine a share | p=quarantine; pct=10; rua=… | No real mail turns up failing in the reports |
| 3. Quarantine all | p=quarantine; rua=… | Still clean after another week or two |
| 4. Reject | p=reject; rua=… | Optional, for the strongest protection |
The usual surprise in the reports is a tool you forgot sends mail as you: a CRM, an invoicing app, a website contact form or a shop platform. Each needs to be in your SPF record or, better, set up to sign with DKIM for your domain before you tighten the policy.
Common DMARC mistakes
- Record added at the root (
yourdomain.com) instead of_dmarc.yourdomain.com. Inboxes only look at_dmarc. - Two DMARC records. Merge them into one.
- Typos in the tags, such as
v=DMARCor a missing semicolon. Paste the record from a generator rather than typing it. - Jumping straight to p=reject before reading reports, which can silently block mail from services you use.
- Reports going to someone else’s domain without permission. External report addresses need a matching authorisation record on that domain; DMARC report services set this up for you.
Frequently asked questions
What is a good DMARC record to start with?
v=DMARC1; p=none; rua=mailto:[email protected]. It meets the Gmail, Yahoo and Microsoft bulk sender rule, changes nothing about delivery, and starts the reports you need before moving to quarantine.
How long does a DMARC record take to work?
Usually minutes, at most a few hours, depending on your DNS host. Reports start arriving the day after the record is live, once providers have received mail from you.
Does DMARC stop my emails going to spam?
It helps, because inboxes trust a domain that proves who sends for it, and the big providers expect it. It is not the only factor: SPF, DKIM, a low spam-complaint rate, an easy unsubscribe and wanted content all matter. Our guide on why emails go to spam covers the rest.
Do I need DMARC if I only use Gmail or Outlook with my domain?
Yes. With your own domain on Google Workspace or Microsoft 365, the DNS records are yours to add: turn on DKIM in the admin console, add the SPF record they give you, then add the DMARC record yourself in your DNS.