How to Add a DMARC Record (Step-by-Step for Any Domain)

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the policy layer on top of SPF and DKIM. It tells receiving servers what to do when email from your domain fails authentication — and gives you reports showing who’s sending on your behalf. Without it, your domain can be freely spoofed in phishing campaigns.

Before You Start: SPF and DKIM

DMARC requires at least one of SPF or DKIM to be passing and aligned. If neither is set up:

1. Set up SPF first — see how to fix SPF failures
2. Set up DKIM with your mail provider (Google Workspace, Microsoft 365, etc. each have their own setup)
3. Then add DMARC

Check your current status with DomainScan’s email authentication checker.

Step 1: Create Your DMARC Record

A DMARC record is a TXT record added at the hostname _dmarc.yourdomain.com.

Minimum Valid DMARC Record

v=DMARC1; p=none;

This does nothing except confirm DMARC is configured. Add a reporting address to make it useful:

v=DMARC1; p=none; rua=mailto:[email protected];

This starts sending you daily aggregate reports of who’s sending email using your domain.

Full DMARC Record with All Common Tags

v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; adkim=s; aspf=s; pct=100; fo=1;

Understanding Each DMARC Tag

Alignment: Relaxed vs Strict

DKIM alignment: Does the d= domain in the DKIM signature match the From: domain?

• adkim=r (relaxed): subdomain match is OK (e.g., DKIM signed by mail.example.com passes for from: example.com)
• adkim=s (strict): exact match required

SPF alignment: Does the Return-Path (envelope sender) domain match the From: domain?

• aspf=r (relaxed): subdomain match OK
• aspf=s (strict): exact match required

For most setups, relaxed alignment (r) is the right choice. Strict alignment can cause failures with mailing lists and forwarding scenarios.

Using pct for Gradual Rollout

pct=10 means “apply the policy to 10% of failing messages.” Use this when moving from p=none to enforcement to test impact before applying to all mail:

v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected];

Increase pct over days/weeks while monitoring reports before setting pct=100.

Step 2: Add the DNS Record

Add this as a TXT record in your DNS provider:

The full hostname will be _dmarc.yourdomain.com. DNS providers handle the suffix automatically — just enter _dmarc in the Name field.

Verify it’s live with DomainScan’s DMARC checker — propagation usually takes 5–30 minutes.

Step 3: Read Your Reports

Aggregate reports arrive as XML email attachments (usually .xml.gz files). They contain:

<record>
  <row>
    <source_ip>209.85.220.41</source_ip>
    <count>142</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>pass</spf>
    </policy_evaluated>
  </row>
</record>

What to look for:

1. Source IPs you don’t recognize: These are either legitimate services you forgot to authorize (add them to SPF/DKIM) or attempts to spoof your domain
2. dkim: fail + spf: fail for known IPs: Your authentication isn’t properly configured for those senders
3. High count from unknown IPs: Someone is attempting to spoof your domain at scale

Use a DMARC report parser (free options exist) to turn XML into a readable dashboard, or read DomainScan’s guide to reading DMARC reports.

Step 4: Fix Authentication for All Legitimate Senders

Before moving to enforcement (p=quarantine or p=reject), ensure every legitimate sending source in your reports is passing DMARC:

• dkim=pass AND spf=pass: Already good
• dkim=fail, spf=pass: Set up DKIM for this service
• dkim=pass, spf=fail: Fix SPF — add this service’s include: to your SPF record
• Both fail: Fix both before enforcing

A source that fails DMARC and is in your p=quarantine or p=reject policy will have its email rejected.

Step 5: Move to Enforcement

Once 2–4 weeks of reports show all legitimate senders passing:

Phase 1: Quarantine with 10%

v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected];

Watch reports for a few days. If legitimate email is being quarantined, something is still misconfigured.

Phase 2: Quarantine at 100%

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected];

Phase 3: Reject

v=DMARC1; p=reject; rua=mailto:[email protected];

p=reject is the end goal. It tells receiving servers to reject email that fails DMARC entirely — your domain cannot be used in phishing campaigns that would reach inboxes.

DMARC for Subdomains

By default, subdomains inherit the root domain’s p policy. Use sp to set a different policy for subdomains:

v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected];

If a subdomain sends email with different senders, add a separate DMARC record at _dmarc.subdomain.yourdomain.com.

Common DMARC Mistakes

After setting up DMARC, verify your full email authentication posture with DomainScan’s email authentication checker.