How to Set Up a DMARC Policy Step by Step

Step-by-step

1. Make sure SPF and DKIM are set up for every service that sends mail with your domain.
2. Open the DMARC Generator, enter your domain and choose p=none.
3. Add an aggregate report address (rua). A dedicated mailbox or a DMARC reporting service works best, because reports can be frequent.
4. Publish the record as a TXT record at _dmarc on your domain and check it with the DMARC Validator.
5. Read the reports for a few weeks. Fix any legitimate sender that fails by correcting its SPF or DKIM setup.
6. Move to p=quarantine, optionally with a small pct such as 10, and raise the percentage over time.
7. When no legitimate mail is failing, move to p=reject.

How DMARC passes

DMARC passes when SPF or DKIM passes and the domain used aligns with the visible From domain. Relaxed alignment, the default, accepts subdomains of the From domain. Strict alignment requires an exact match.

Reading the reports

Aggregate reports are XML files sent by receivers, usually once a day. They list the sending servers, how many messages each sent and whether SPF and DKIM passed. They are hard to read by hand, so many people use a free or paid DMARC reporting service and point rua at it.

Why legitimate mail fails

The usual causes are a service that was never added to SPF, a service that signs with its own domain instead of yours, and forwarding. Forwarding often breaks SPF, so DKIM that survives the forward matters. Fix these before you enforce.

Subdomains and rollout

The sp tag sets a separate policy for subdomains. A subdomain with no DMARC record of its own uses the policy of the organizational domain. Mailbox providers such as Gmail and Yahoo require SPF, DKIM and a DMARC policy from bulk senders, so even p=none is worth publishing.