How to Set Up DMARC for Google Workspace (Step-by-Step)

DMARC on Google Workspace has a right way and a wrong way. Right way: monitor first, enforce later. Wrong way: publish p=reject on day one and watch legitimate mail bounce.

Prerequisites

SPF configured and passing (see how to set up SPF for Google Workspace)
DKIM enabled in Admin console (see DKIM selector FAQ)
Access to your DNS host
A monitored mailbox for aggregate reports

Step 1 — Publish the Initial DMARC Record

At your DNS host, add a TXT record:

Name — _dmarc (subdomain)
Type — TXT
Value — v=DMARC1; p=none; rua=mailto:[email protected]; fo=1
TTL — 3600

Full record name: _dmarc.yourdomain.com.

Explanation:

p=none — monitor mode. No mail is rejected. You just receive reports.
rua= — where daily aggregate reports go. Set this to a mailbox you’ll actually read.
fo=1 — request forensic reports when any authentication mechanism fails (some providers ignore this).

Verify with the DMARC lookup tool.

Step 2 — Wait and Collect Reports (4-8 Weeks)

Google, Yahoo, Outlook, and most large receivers send daily aggregate XML reports to your rua= address. Each report shows:

Source IPs that sent mail claiming your domain
Whether SPF passed
Whether DKIM passed
What DMARC alignment result was

Use a report parser (dmarcian, EasyDMARC, Postmark DMARC Digest, or a self-hosted tool) to turn XML into visualizations.

Look for:

Unknown IPs — shadow-IT SaaS tools sending as your domain. Add their SPF includes.
DKIM failures — DKIM key not published, or wrong selector. Fix in Google Admin console.
Cross-country sends — legitimate global senders or spoofing? Investigate.

Step 3 — Step Up to `p=quarantine`

Once aggregate reports show:

Every legitimate sender passing SPF
Every legitimate sender passing DKIM
Zero unexplained failures for 2+ weeks

Change your record to:

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]; fo=1

p=quarantine — non-aligned mail goes to spam folder (not rejected)
pct=25 — only 25% of failing mail affected initially — safety valve

Ramp pct=25 → 50 → 100 over 4-6 weeks.

Step 4 — Step Up to `p=reject`

After p=quarantine; pct=100 for 4+ weeks with clean reports:

v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1

Non-aligned mail is now outright rejected. Full DMARC enforcement.

Step 5 — Add BIMI (Optional)

At p=quarantine or p=reject, you become eligible for BIMI — the logo-next-to-message feature in Gmail. See the BIMI glossary entry.

Common Miss

Skipping the monitoring phase and going straight to p=reject — legitimate mail bounces silently
Not enabling DKIM in Admin console — DMARC alignment fails
Wrong _dmarc subdomain (using dmarc without underscore) — record ignored
Multiple DMARC records — receivers ignore both

Verify each step with the DMARC lookup tool and the email authentication checker.

Read what DMARC is, the DMARC glossary entry, and learn how to read a DMARC report.