How to set up DMARC, from p=none to p=reject
DMARC tells receivers what to do with mail that fails SPF and DKIM and sends you reports. Start with p=none, read the reports, then enforce.
Check your own domain
Our Email & DNS health tool runs these 3 checks and writes the record to add, free, in seconds.
What a passing site looks like
- The domain publishes a DMARC recordfail · −25 ptseffort S
- DMARC policy: passeswarning · −6 ptseffort M
- DMARC reports: passesinfo onlyeffort S
1. No DMARC record, so receivers get no rule for spoofed mail
Why it matters. Since February 2024, Gmail and Yahoo require DMARC from anyone who sends them more than 5,000 messages a day. DMARC also tells receivers what to do with mail that pretends to come from your exact domain.
- Add a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:reports@yourdomain to start collecting reports.
- After a few weeks of clean reports, move to p=quarantine and then p=reject.
2. DMARC policy
Why it matters. p=none only collects reports; receivers still deliver mail that fails. Quarantine sends it to spam and reject refuses it, which is what actually protects your name.
- Read the DMARC reports until every real sender passes, then set p=quarantine, and p=reject a few weeks later.
- Start with pct=25 on quarantine if you want to move in steps.
3. DMARC sends no reports (no rua address)
Why it matters. The aggregate reports (rua) are how you find every service that sends as your domain before you tighten the policy. Without them you are guessing.
- Add rua=mailto:dmarc@yourdomain (or the address of a free DMARC report reader) to the DMARC record.