How to Set Up DMARC: Step-by-Step Guide (p=none to p=reject) | InboxVerify
Guide

How to set up DMARC, step by step

Create your first DMARC record, read the reports, authenticate every sender and move safely from p=none to quarantine and reject.

Updated October 12, 2026 · 8 min read · By the InboxVerify team

DMARC protects your domain from spoofing and is required by Gmail and Yahoo for bulk senders. Rolling it out safely takes a few weeks: you start by only watching, then tighten the policy once you know every legitimate sender is authenticated.

Before you start

  • SPF is published and includes your main email provider
  • DKIM is enabled for your main email provider
  • You know which tools send email as your domain (CRM, newsletter, help desk, website, invoices)

Step 1: Publish a monitoring record

Add a TXT record with the host _dmarc:

TXT · _dmarc
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

p=none changes nothing for delivery — it only turns on reporting. Use the DMARC Generator to build the record and the DMARC Checker to confirm it is live.

Step 2: Read the aggregate reports

Receivers send daily XML reports to the rua address. They list every IP that sent mail using your domain and whether SPF and DKIM passed and aligned. A DMARC report analyser makes them readable.

Step 3: Authenticate every legitimate sender

  • Add each service to SPF (watch the 10-lookup limit)
  • Enable DKIM with your domain in each service
  • Set up a custom sending / return-path domain where the service offers it, so SPF aligns too

Step 4: Move to quarantine

TXT · _dmarc
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.com

Start with a percentage such as pct=25 and increase to 100 over a few weeks while watching reports and bounces. (Not every receiver honours partial percentages exactly, so treat it as a gradual safety net, not a precise dial.)

Step 5: Move to reject

TXT · _dmarc
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com

At p=reject spoofed mail is blocked outright. Keep reading reports — new tools added later must be authenticated before they send.

Common mistakes

  • Two DMARC records (only one is allowed)
  • Jumping straight to p=reject and blocking your own invoices or newsletters
  • Reporting address at another domain without the authorisation record that domain needs
  • Forgetting subdomains — use sp= to set their policy

Frequently asked questions

How long should I stay at p=none?

Usually 2–4 weeks, until reports show all legitimate mail passing.

Is p=none enough for Gmail and Yahoo?

Their bulk sender rules require a DMARC record; p=none satisfies the minimum, but a stronger policy gives better protection.

What does fo=1 do?

It asks for failure (forensic) reports when either SPF or DKIM fails, not only when both fail. It only has an effect together with a ruf= address, and many receivers never send failure reports.