How to set up DMARC, from p=none to p=reject
DMARC tells receivers what to do with mail that fails SPF and DKIM and sends you reports. Start with p=none, read the reports, then enforce.
Step by step, with screenshots: What is DMARC? How it works, and your first DMARC record →
Check your own domain
Our DMARC checker (email & DNS) tool runs these 3 checks and writes the record to add, free, in seconds.
What it is
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks, and where to send reports about it. It is published as a TXT record at _dmarc.yourdomain.
Since February 2024, Gmail and Yahoo require a DMARC record from anyone sending more than 5,000 messages a day to their users, and Microsoft's consumer mailboxes followed in 2025. getReport checks that the record exists, whether its policy only monitors (p=none) or actually protects (quarantine or reject), and whether it asks for aggregate reports. You are protected when the policy is quarantine or reject and all your legitimate mail passes.
What a passing site looks like
- The domain publishes a DMARC recordfail · −25 ptseffort S
- DMARC policy: passeswarning · −6 ptseffort M
- DMARC reports: passesinfo onlyeffort S
1. DMARC record
Why it matters. Since February 2024, Gmail and Yahoo require DMARC from anyone who sends them more than 5,000 messages a day. DMARC also tells receivers what to do with mail that pretends to come from your exact domain.
- Add a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:reports@yourdomain to start collecting reports.
- After a few weeks of clean reports, move to p=quarantine and then p=reject.
- If there are two or more DMARC records, merge them into one: receivers ignore all of them.
2. DMARC policy
Why it matters. p=none only collects reports; receivers still deliver mail that fails. Quarantine sends it to spam and reject refuses it, which is what actually protects your name.
- Read the DMARC reports until every real sender passes, then set p=quarantine, and p=reject a few weeks later.
- To move in steps, add t=y while on quarantine: receivers then apply one level softer (none) until you remove it. The old pct tag was dropped in RFC 9989 (May 2026).
3. DMARC sends no reports (no rua address)
Why it matters. The aggregate reports (rua) are how you find every service that sends as your domain before you tighten the policy. Without them you are guessing.
- Add rua=mailto:dmarc@yourdomain (or the address of a free DMARC report reader) to the DMARC record.
Questions people ask
What does a DMARC record look like?
A basic record is a TXT record at _dmarc.example.com with the value v=DMARC1; p=none; rua=mailto:dmarc@example.com. v=DMARC1 identifies it, p sets the policy for failing mail, and rua is where daily aggregate reports go. Optional tags include sp for subdomains and t=y, which asks receivers to apply one level softer while you test (it replaced pct in RFC 9989, May 2026). Publish exactly one DMARC record per domain.
What is the difference between DMARC p=none, quarantine and reject?
p=none only monitors: receivers deliver failing mail as usual and send you reports. p=quarantine asks them to put failing mail in spam, and p=reject asks them to refuse it outright. Only quarantine and reject protect your name from spoofing. Start with none, confirm in the reports that all your real senders pass, then move up step by step.
What does "DMARC quarantine/reject policy not enabled" mean?
It is a finding from security scanners and email checkers that your DMARC record exists but uses p=none. Your domain is being monitored, not protected, so spoofed mail still reaches inboxes. Once your reports show that your own services pass SPF or DKIM with alignment, change the policy to p=quarantine, and later to p=reject.
What is a DMARC report?
Aggregate (rua) reports are daily XML files that receivers such as Google, Microsoft and Yahoo send to the address in your record. They list every IP address that sent mail as your domain, how many messages it sent, and whether each passed SPF and DKIM. A DMARC report analyser turns the XML into readable tables, which is how you find forgotten senders before enforcing.
Why does DMARC fail?
DMARC passes only when SPF or DKIM passes and the domain they check matches the From address. It usually fails because a service sends as your domain without being in your SPF record or signing with your DKIM key, because a provider signs with its own domain instead of yours, or because forwarding broke SPF. Your reports show which source failed.