# How to set up DMARC, from p=none to p=reject

> DMARC tells receivers what to do with mail that fails SPF and DKIM and sends you reports. Start with p=none, read the reports, then enforce.

Security · HTML version: https://getreport.app/learn/dmarc

## DMARC record

Passing looks like: The domain publishes a DMARC record.

**Why it matters.** Since February 2024, Gmail and Yahoo require DMARC from anyone who sends them more than 5,000 messages a day. DMARC also tells receivers what to do with mail that pretends to come from your exact domain.

**How to fix it.**

1. Add a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:reports@yourdomain to start collecting reports.
2. After a few weeks of clean reports, move to p=quarantine and then p=reject.

## DMARC policy

Passing looks like: DMARC policy passes.

**Why it matters.** p=none only collects reports; receivers still deliver mail that fails. Quarantine sends it to spam and reject refuses it, which is what actually protects your name.

**How to fix it.**

1. Read the DMARC reports until every real sender passes, then set p=quarantine, and p=reject a few weeks later.
2. Start with pct=25 on quarantine if you want to move in steps.

## DMARC reports

Passing looks like: DMARC reports passes.

**Why it matters.** The aggregate reports (rua) are how you find every service that sends as your domain before you tighten the policy. Without them you are guessing.

**How to fix it.**

1. Add rua=mailto:dmarc@yourdomain (or the address of a free DMARC report reader) to the DMARC record.

Check your own page: https://getreport.app/