DMARC tells receiving servers what to do when your emails fail SPF or DKIM - and it sends you daily reports so you can see who is sending email as your domain. Without DMARC, you have no visibility into spoofing and no control over how authentication failures are handled. This guide covers the correct TXT record syntax, how to read aggregate reports, and the safe step-by-step path from p=none to p=reject.
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=r
v=DMARC1
Required. Declares DMARC version 1. Always first.
p=none/quarantine/reject
Policy for emails that fail DMARC. Start with p=none.
rua=mailto:
Aggregate report destination. Daily XML reports sent here. Use a dedicated inbox or a DMARC parser service.
ruf=mailto:
Forensic report destination. Per-failure reports. Optional and noisy - many providers don’t send ruf reports anyway.
pct=100
Percentage of failing mail to apply policy to. Use pct=10 to ramp up enforcement gradually. Default is 100.
adkim=r
DKIM alignment mode. r=relaxed (subdomains OK), s=strict (exact match). Use r unless you have a reason for strict.
aspf=r
SPF alignment mode. Same relaxed/strict logic as adkim.
fo=1
Forensic report options. fo=1 = send report when SPF OR DKIM fails. fo=0 = only when both fail.
Publish: v=DMARC1; p=none; rua=mailto:[email protected]
Goal: identify every legitimate sender. Check reports in dmarcian, EasyDMARC, or Postmark DMARC. Expect to find: your ESP, CRM, support system, transactional email, third-party senders.
For each source in your reports that is failing: add it to SPF (include: or ip4:), confirm DKIM is signing, and verify alignment. Do not advance to p=quarantine until all legitimate senders show dmarc=pass in reports.
Update to: v=DMARC1; p=quarantine; pct=10; rua=mailto:...
10% of failing mail goes to spam. Monitor for any legitimate mail going missing. Increase pct=25, pct=50, pct=100 over 2 weeks.
Update to: v=DMARC1; p=reject; rua=mailto:...
Spoofed mail is refused at delivery. Your domain is now fully protected from impersonation. Keep monitoring reports to catch new sending sources.
| Tool | Cost | Best for |
|---|---|---|
| Google Postmaster Tools | Free | Gmail-specific domain reputation and DMARC compliance view |
| Postmark DMARC | Free | Parsing rua reports into a clean dashboard; no account needed to start |
| dmarcian | $25-200/mo | Enterprises needing detailed source analysis and team collaboration |
| EasyDMARC | Free - $100/mo | Good balance of features and price; supports multiple domains |
| Valimail | Free - enterprise | Automatic SPF flattening + DMARC monitoring in one |
| MXToolbox DMARC Lookup | Free | Quick one-off check that your DMARC record is published correctly |
If any legitimate sender fails DMARC (your CRM, support system, ESP) and you’re on p=reject, their emails are silently dropped. Always spend 30+ days on p=none first.
Without aggregate reports, DMARC is blind. You have no idea if legitimate mail is failing or if someone is spoofing your domain. Always set rua=.
DMARC does not automatically apply to subdomains. Set sp=reject (subdomain policy) or publish a separate DMARC record at _dmarc.subdomain.yourdomain.com for each sending subdomain.
SPF-only DMARC alignment breaks under email forwarding (the forwarding server changes the sending IP, breaking SPF). DKIM survives forwarding. For robust DMARC, ensure DKIM is signing and aligning.
pct= defaults to 100. If you publish p=quarantine without pct=10, you immediately quarantine 100% of failing mail - including any legitimate sources you missed during monitoring.
DMARC stops spoofing. A verified list stops bounces. Run both on every sending domain. 100 free credits, no card required.
Provider behaviour, DNS setup, warm-up, and inbox placement
Continue through related topics