In short
- Always start at p=none — going straight to reject blocks real mail.
- DMARC needs SPF or DKIM to pass AND align with your From domain.
- Use rua= to collect aggregate reports and find unknown senders.
- Raise enforcement only when reports are clean.
Steps
- Confirm SPF and DKIM are already published and passing.
- Publish a TXT record at _dmarc.yourdomain.com with p=none and rua=mailto:your-report-address.
- Collect aggregate reports for two to four weeks.
- Identify every source sending as your domain and fix or remove each one.
- Move to p=quarantine and watch for fallout.
- Move to p=reject once legitimate mail consistently aligns.
Record anatomy
Monitoring
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1Enforcing with strict alignment
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc@yourdomain.com; pct=100Tags worth knowing
- p — policy for the organisational domain: none, quarantine, or reject.
- sp — policy for subdomains; set it explicitly if you send from subdomains.
- adkim / aspf — alignment mode: s (strict) or r (relaxed).
- pct — percentage of mail the policy applies to, useful for phased rollout.
- rua — where aggregate reports are sent.
Why DMARC matters for bulk senders
Major mailbox providers now expect bulk senders to publish DMARC and to authenticate properly. It also stops others spoofing your domain, which protects the reputation your campaigns depend on.
Checklist
- SPF and DKIM passing before DMARC enforcement.
- DMARC published at _dmarc with a reporting address.
- Reports reviewed and unknown senders resolved.
- Subdomain policy set explicitly if relevant.
- Policy raised gradually: none, quarantine, reject.
Run these checks now
Questions people ask
Will p=reject break my mail?
It will reject anything that does not align — including legitimate services you forgot about. That is exactly why you run p=none first and read the reports.
Do I need a DMARC report analyser?
Aggregate reports are XML, so a viewer or service helps at scale. For a single domain with a few senders, they are readable manually.
Strict or relaxed alignment?
Relaxed is the safer default and allows subdomain alignment. Use strict only when you control every sender and need exact domain matching.