DMARC setup guide
How to protect your domain against spoofing without losing legitimate email. Allow a few weeks: most of the work is finding every service that sends as you.
Where to make these changes: all records below are DNS records at the company where your domain's DNS is hosted (often your domain registrar, e.g. one.com, GoDaddy, Cloudflare, Simply, Namecheap or AWS Route 53). Look for “DNS settings” or “DNS records”. Changes usually take effect within an hour.
How DMARC works, in short
Anyone can put your address in the From line of an email. DMARC lets receivers check that a message really comes from you, using two older standards:
- SPF lists the servers allowed to send for your domain.
- DKIM adds a cryptographic signature to each message, checked against a public key in your DNS.
A message passes DMARC when SPF or DKIM passes and its domain matches the From domain (“alignment”). Your DMARC record tells receivers what to do with messages that fail (nothing, spam folder, or refuse) and where to send daily reports about everything they saw from your domain.
Step 1: SPF
Publish one TXT record on the domain itself (host @) that lists every service sending as you, and ends with ~all or -all:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
- Only one SPF record per domain. Two records make SPF fail. Add new services to the existing one.
- Common includes: Google Workspace
include:_spf.google.com, Microsoft 365include:spf.protection.outlook.com, Mailchimp/Mandrillinclude:servers.mcsv.net, SendGridinclude:sendgrid.net, one.cominclude:_custspf.one.com. Your provider's help pages give the exact value. - SPF allows at most 10 DNS lookups, including nested includes. The checker counts them for you.
- A domain that never sends email should publish
v=spf1 -all.
Step 2: DKIM
DKIM is switched on at each sending service, which then gives you one or more DNS records to publish (TXT or CNAME, at a name like selector1._domainkey).
- Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (2048 bits), publish the TXT record at
google._domainkey, then click “Start authentication”. - Microsoft 365: Defender portal → Email & collaboration → Policies → Threat policies → Email authentication settings → DKIM. Publish the two CNAME records (
selector1._domainkeyandselector2._domainkey), then enable signing. - Newsletter and transactional services (Mailchimp, SendGrid, Brevo, HubSpot …): look for “domain authentication” in their settings.
DKIM matters most for DMARC: it survives forwarding, which SPF doesn't. Send a test email from each service to check its signature.
Step 3: DMARC with p=none
Publish a TXT record at host _dmarc (the full name is _dmarc.yourdomain.com):
v=DMARC1; p=none; rua=mailto:r-yourtoken@dmarctool.cloudcircus.com
p=none only asks for reports: nothing happens to your mail yet. Create a free account and add your domain to get your own report address (rua=); the app shows the exact record to publish, merged with any record you already have. More about sending reports to DMARC Tool.
| v=DMARC1 | Required, and must come first. |
|---|---|
| p= | What receivers do with failing mail: none (deliver), quarantine (spam folder), reject (refuse). |
| rua= | Where receivers send daily aggregate reports. Several addresses are separated by commas. |
| sp= | Policy for subdomains, if it should differ from p=. |
| pct= | Apply the policy to only this percentage of failing mail (for a gradual start). Default 100. |
| adkim= aspf= | Alignment: r (relaxed, default: subdomains match) or s (strict: exact match). |
| ruf= | Failure reports. Rarely sent, and they can contain personal data; DMARC Tool doesn't accept them. |
Step 4: read the reports and fix your senders
Within a day or two, Google, Microsoft, Yahoo and others start sending reports. The dashboard groups them by sender. For each sender that fails:
- A service you use (your CRM, invoicing system, newsletter tool): set up SPF and/or DKIM for it as in steps 1 and 2.
- Forwarding and mailing lists often break SPF; with DKIM they still pass. A small share of failures from these is normal.
- Servers you don't recognise are usually spoofing: exactly what DMARC will stop.
Step 5: quarantine, then reject
When the reports show that all your own mail passes (typically after 2–6 weeks), tighten the policy in steps, watching the reports in between:
v=DMARC1; p=quarantine; pct=25; rua=… v=DMARC1; p=quarantine; rua=… v=DMARC1; p=reject; rua=…
Keep the rua= address: the reports tell you when a new service starts sending as you, or a sender breaks.
Domains that don't send email
Spammers like unused domains. Lock them down right away:
@ TXT v=spf1 -all _dmarc TXT v=DMARC1; p=reject; rua=mailto:…