This DMARC record setup guide is written for anyone who already has SPF and DKIM in place but hasn't taken the final step of publishing a DMARC policy. That step matters more than most people realize — without it, receiving servers are left to decide on their own what to do with messages that fail authentication, and you get zero visibility into who's sending mail as your domain.
What DMARC adds on top of SPF and DKIM
SPF checks which servers can send for your domain. DKIM checks that a message wasn't altered. DMARC ties both together and answers one more question: what should happen when a message fails one or both checks? It also enables reporting, so you can see exactly which sources are sending mail claiming to be from your domain — including spoofing attempts. If you haven't set up the first two records yet, start with DKIM setup for Google Workspace before coming back here.
Step 1: Understand the policy tags
A DMARC record is a single TXT record published at _dmarc.yourdomain.com. A basic version looks like this: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
p= — the policy: none, quarantine, or reject rua= — where aggregate reports get sent pct= — optional, the percentage of mail the policy applies to during rollout The policy tag is the part most people get wrong, either by skipping it entirely or jumping straight to reject without testing first. The full breakdown of what each option does is covered in DMARC policy: p=none vs p=quarantine vs p=reject explained.
Step 2: Start at p=none
Always start with p=none. This publishes the record and starts generating reports without affecting delivery of any mail — even messages that fail authentication still land normally. This gives you a monitoring period to confirm every legitimate sending source is passing before you enforce anything.
Step 3: Publish the record
Add the TXT record at _dmarc.yourdomain.com (not the root domain — this is a common mistake) through your DNS provider. Double-check the host field, since a record published at the wrong subdomain won't be picked up at all.
Step 4: Read the reports
Aggregate reports (rua) arrive as XML files from major inbox providers, typically daily. They'll show every server sending mail as your domain and whether each one passed SPF and DKIM. If you spot a legitimate sending source failing, that's your cue to go fix the underlying record — usually SPF, so revisit how to set up an SPF record if that's the gap.
Step 5: Move toward enforcement
Once reports confirm all legitimate senders are passing consistently, move from p=none to p=quarantine, and eventually p=reject, if you want full enforcement. This step-up should happen gradually, not all at once.
Step 6: Verify along the way
At each stage, confirm the record is live and correctly formatted using aDMARC checker. If you want to confirm the whole chain — SPF, DKIM, and DMARC — is working together on a live message, check the raw email headers or pass/fail results on each check. Following this DMARC record setup guide in order — publish, monitor, then enforce — is the difference between a policy that protects your domain and one that accidentally blocks your own legitimate mail.
FAQ
Where do I publish a DMARC record?
At _dmarc.yourdomain.com, not the root domain. Publishing it at the wrong host is one of the most common setup mistakes and results in the record simply not being picked up.
What policy should I start with when following a DMARC record setup guide?
Always start with p=none. This monitors authentication results without affecting mail delivery, giving you a safe window to confirm all legitimate senders are passing before enforcing anything.
Do I need SPF and DKIM before setting up DMARC?
Yes. DMARC evaluates the results of SPF and DKIM checks — without at least one of them in place, DMARC has nothing to act on and won't function as intended.
How do I read a DMARC aggregate report?
Aggregate reports arrive as XML files, usually daily, from major inbox providers. They list every source sending mail as your domain along with pass/fail results for SPF and DKIM alignment.
How long should I stay on p=none before moving to enforcement?
There's no fixed timeline, but most domains monitor for at least a week or two to capture a full sending cycle before moving to p=quarantine, since you want enough report data to confirm every legitimate source is passing.