If you need a practical answer fast: create a TXT record at _dmarc.yourdomain.com with a valid DMARC policy (p=none, p=quarantine, or p=reject) and reporting addresses (rua, optionally ruf). Then verify propagation globally before tightening enforcement.
What is a DMARC record?
A DMARC record is a DNS policy that tells receiving mail servers what to do when messages fail SPF or DKIM checks. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the enforcement layer that sits on top of SPF and DKIM.
In plain language, DMARC decides whether failing mail should:
- be monitored only (
p=none) - be routed to spam/junk (
p=quarantine) - be blocked completely (
p=reject)
Why DMARC matters for security and deliverability
Without DMARC, attackers can spoof your domain more easily in phishing campaigns. With DMARC, mailbox providers like Gmail, Microsoft, Yahoo, AOL, and iCloud receive explicit handling instructions for unauthenticated mail.
Benefits include:
- Reduced spoofing and phishing abuse
- Visibility into senders using your domain
- Better sender trust with major inbox providers
- Improved long-term deliverability when policies are tuned correctly
DMARC policies explained
p=none (monitoring mode)
Use this first. Messages still deliver normally, but aggregate reports are collected so you can validate real traffic safely.
p=quarantine (soft enforcement)
Failing messages are usually sent to spam or junk. This is a safe midpoint after you confirm legitimate senders are aligned.
p=reject (full enforcement)
Failing messages are blocked at SMTP time. Use this only after SPF, DKIM, and alignment are consistently passing.
How to create a DMARC record (step-by-step)
1) Open DNS management for your domain
Sign in to your DNS host (registrar, DNS provider, or hosting control panel).
2) Add a TXT record
- Host/Name:
_dmarc - Type:
TXT - TTL: default (or 300 while testing)
3) Paste a DMARC value
Start with monitoring:
v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
4) Save and wait for DNS propagation
Most changes appear within a few hours, but full resolver propagation can take up to 24 hours depending on TTL and caching.
5) Verify from multiple locations
Check _dmarc.yourdomain.com with global DNS lookups before changing policy strength.
DMARC record examples you can use
Monitoring only
v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
Quarantine policy
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com
Reject policy
v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com
Example with forensic reporting
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; ruf=mailto:forensics@yourdomain.com; fo=1
RUA and RUF: what reporting tags do
rua (aggregate reports)
Sends summarized daily XML reports showing pass/fail trends, source IPs, and alignment outcomes.
ruf (forensic/failure reports)
Sends near-real-time failure samples where supported. Use carefully because data can be sensitive.
How DMARC passes (and why it can fail)
A message passes DMARC when:
- SPF or DKIM passes, and
- The authenticated domain aligns with the visible
From:domain.
Common failure pattern: SPF passes for a third-party envelope sender, but alignment fails because the domain does not match your From: address.
Common DMARC mistakes checklist
- No DMARC record published at all
- Invalid TXT syntax (missing semicolons, bad spacing, typos)
- Missing or undeliverable
rua/rufmailbox - SPF or DKIM not configured for all senders
- Alignment not tested before moving to enforcement
- Switching directly to
p=rejecttoo early - Ignoring reports after deployment
Recommended rollout plan
- Publish
p=noneand monitor reports for 1–2 weeks. - Fix SPF/DKIM/alignment for all legitimate platforms.
- Move to
p=quarantineand monitor impact. - Move to
p=rejectwhen failures are understood and acceptable.
Practical verification commands
dig +short TXT _dmarc.example.com
nslookup -type=TXT _dmarc.example.com
Related resources
- MX, SPF, DKIM, and DMARC Setup for Better Inbox Delivery
- Read Email Headers to Diagnose SPF and DKIM Fails
- SPF Record Exceeds 10 Lookup Limit, Fix It Fast
- DNS Propagation Troubleshooting
Frequently asked questions
How long does DMARC take to start working?
Many resolvers pick up the new TXT record quickly, but global consistency may still take up to 24 hours (or longer if previous TTL values were high).
Should I start with p=reject?
Usually no. Start with p=none, validate legitimate traffic, then increase enforcement gradually.
Why is DMARC failing when SPF passes?
Most often because SPF passed for a non-aligned domain. DMARC still fails if alignment with your visible From: domain is not satisfied.
How do I check DMARC propagation globally?
Query authoritative and public resolvers from multiple regions and compare returned TXT values before assuming enforcement is active everywhere.