How to set up DMARC, step by step

Last updated 12 October 2026 · By the XKey team

What does DMARC do?

When an email claims to come from your domain, the receiving server checks SPF and DKIM. DMARC is a short TXT record that tells it what to do if neither passes for your domain: let it through (none), put it in spam (quarantine) or refuse it (reject). It also asks receivers to send you daily reports listing every server that sent email using your domain – so you find forgotten tools and spot spoofing.

Before you start: SPF and DKIM

DMARC only works on top of SPF and DKIM. Set those up first for every service that sends as you. Check them with the SPF checker and DKIM checker.

Stage 1: monitor (p=none)

Add a TXT record named _dmarc at your domain:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk

Nothing is blocked. Reports start arriving within a day or two as zipped XML files – hard to read by hand, so many people use a free DMARC report service, which turns them into a simple list of senders and pass rates. Leave this running for two to four weeks.

Stage 2: read the reports

Look for every service sending as your domain. Each should show SPF or DKIM passing and aligned (the domain that passed matches your From address). Typical finds: the website contact form, an old newsletter account, invoicing or booking software, a scanner or printer that emails documents. Fix each one by adding it to SPF or setting up its DKIM records – or stop it sending as your domain.

Stage 3: quarantine

When your real email passes, change the record to:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.co.uk

pct=25 applies the policy to a quarter of failing mail at first. Raise it to 50, then 100, over a couple of weeks while watching the reports.

Stage 4: reject

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.co.uk

Now fake emails using your domain are refused outright. This is the strongest protection against invoice fraud in your name, and the level banks and government sites use.

What the other tags mean

• sp= – the policy for subdomains (defaults to the same as p).
• adkim=s / aspf=s – strict alignment; leave them out (relaxed) unless you know you need them.
• ruf= – forensic reports about single failures; few providers send them, and they can contain personal data.
• fo=1 – ask for failure reports when either check fails.

Domains that never send email

For a domain you own but never send from, publish v=DMARC1; p=reject straight away along with an SPF record of v=spf1 -all, so nobody can use it for fake emails.

Check your record at any stage with the DMARC checker. It reads your policy, explains each tag and warns about mistakes.

Frequently asked questions

Will DMARC stop my emails being delivered?

Not at p=none, which only monitors. Problems only start if you move to quarantine or reject before every service that sends as you passes SPF or DKIM – which is why you read the reports first.

Is DMARC required?

Gmail, Yahoo and Microsoft require at least p=none from bulk senders, and recommend it for everyone. For a small business it's free and protects customers from fake invoices in your name.

Where do DMARC reports go?

To the address in the rua tag. Use a dedicated mailbox or a DMARC report service, because a busy domain can receive dozens of reports a day.