Implementation Guides·Updated 2025-07-01·8 min read

How to Configure DMARC Correctly

Step-by-step guide to setting up DMARC for cold email — policy selection, DNS configuration, reporting setup, and how to progress from monitoring to enforcement.

Quick Answer

Add a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Start with p=none (monitoring), review reports for 2–4 weeks, then tighten to p=quarantine and eventually p=reject.

What DMARC Does
DMARC Policy Levels
DMARC Record Format
Step-by-Step Configuration
Reading DMARC Reports
Progressing from Monitoring to Enforcement

Introduction

DMARC ties SPF and DKIM together and tells receiving servers what to do when either check fails. It also provides reporting so you can monitor your authentication health over time.

This guide covers DMARC policy selection, DNS setup, report configuration, and how to safely progress from monitoring to enforcement.

Who This Guide Is For

• Anyone setting up DNS authentication for cold email
• People who have configured SPF and DKIM but not yet added DMARC
• Teams ready to move from DMARC monitoring to enforcement

Key Takeaways

1. DMARC is a TXT record at _dmarc.yourdomain.com
2. Always start with p=none (monitoring mode)
3. The rua tag sends aggregate reports to your email
4. Progress from p=none to p=quarantine to p=reject over time
5. Never start with p=reject — it will block your email if SPF/DKIM are misconfigured

What DMARC Does

Without DMARC, receiving servers decide independently what to do when SPF or DKIM fail. DMARC lets you tell them: 'If my email fails authentication, here is what should happen.' It also sends you reports about authentication results.

For the full picture of how DMARC works with SPF and DKIM, see our SPF vs DKIM vs DMARC guide.

DMARC Policy Levels

Policy	What Happens on Failure	When to Use
p=none	No action — email is delivered normally	Start here, always
p=quarantine	Failing email goes to spam folder	After 2–4 weeks of clean monitoring
p=reject	Failing email is rejected entirely	Only after extensive monitoring and confidence

⚠️ Warning

Never start with p=reject. If your SPF or DKIM is misconfigured, p=reject will block ALL your email. Start with p=none, monitor, and tighten gradually.

DMARC Record Format

A DMARC record is a TXT record published at _dmarc.yourdomain.com. The basic format:

ℹ️ Info

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Tag	Purpose	Example
v	Version (always DMARC1)	v=DMARC1
p	Policy for failing emails	p=none
rua	Where to send aggregate reports	rua=mailto:dmarc@domain.com
ruf	Where to send forensic reports	ruf=mailto:dmarc-forensic@domain.com
sp	Subdomain policy (optional)	sp=none
adkim	DKIM alignment mode (optional)	adkim=r
aspf	SPF alignment mode (optional)	aspf=r

Step-by-Step Configuration

Log in to your domain registrar's DNS management panel
Create a new TXT record
Set the Host/Name to _dmarc
Set the Value to: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
Set TTL to 3600 or default
Save the record
Wait 24–48 hours for DNS propagation
Verify at MXToolbox DMARC Lookup

💡 Tip

Use a dedicated email address for DMARC reports (dmarc@yourdomain.com). These reports are automated and can be frequent — do not use your primary inbox.

Reading DMARC Reports

DMARC aggregate reports (sent to the rua address) contain data about every email that was evaluated against your DMARC policy. They show you:

How many emails passed SPF, DKIM, or both
How many emails failed SPF, DKIM, or both
Which IP addresses sent email on behalf of your domain
Whether any unauthorized servers are sending email
Volume of email by source and time period

Third-party DMARC reporting tools (like DMARC Analyzer, Agari, or URI Online) parse these raw XML reports into readable dashboards.

Progressing from Monitoring to Enforcement

Start with p=none and collect reports for 2–4 weeks
Verify that SPF and DKIM pass for all legitimate email sources
Confirm no unauthorized servers are sending email
Move to p=quarantine — failing email goes to spam
Monitor for 1–2 weeks to ensure legitimate email is not affected
Move to p=reject — failing email is rejected entirely

⚠️ Warning

Only move to p=reject when you are fully confident that all your email sources are properly authenticated. One misconfigured source will have all its email rejected.

Best Practices

✓ Always start with p=none
✓ Use a dedicated email address for DMARC reports
✓ Review reports for 2–4 weeks before tightening policy
✓ Progress gradually: p=none → p=quarantine → p=reject
✓ Verify no unauthorized servers are sending email before enforcing
✓ Check DMARC status monthly

Mistakes to Avoid

✗ Starting with p=reject — blocks all email if SPF/DKIM are wrong
✗ Not monitoring DMARC reports
✗ Skipping DMARC entirely — many people set up SPF and DKIM but forget DMARC
✗ Using your primary inbox for DMARC reports
✗ Moving to enforcement too quickly

Expert Tips

★ DMARC aggregate reports are your best window into email authentication health
★ Third-party DMARC tools make reports much easier to read than raw XML
★ A properly configured DMARC policy with p=reject is the gold standard for deliverability
★ The Inbox Readiness Score checks your DMARC configuration alongside SPF and DKIM

DMARC Configuration Checklist

☐ TXT record added at _dmarc.yourdomain.com
☐ p=none policy set for initial monitoring
☐ rua tag points to a dedicated email address
☐ DNS propagation waited (24–48 hours)
☐ Record verified at MXToolbox
☐ DMARC reports are being received
☐ Reports reviewed for 2–4 weeks before policy change
☐ Progression plan to p=quarantine and p=reject documented

Summary

DMARC is a TXT record at _dmarc.yourdomain.com that tells receiving servers how to handle authentication failures and where to send reports.

Always start with p=none (monitoring). Collect reports for 2–4 weeks, verify everything is working, then progress to p=quarantine and eventually p=reject.

DMARC completes your three-part authentication system alongside SPF and DKIM. All three are required for optimal cold email deliverability.

Frequently Asked Questions

What happens if I start with p=reject?

Any email that fails SPF or DKIM will be rejected. If your authentication is misconfigured, this blocks all your email — including legitimate sends. Always start with p=none.

How do I read DMARC reports?

Raw DMARC reports are XML files that are hard to read manually. Use a third-party DMARC reporting tool (DMARC Analyzer, Agari, etc.) to parse them into readable dashboards.

Do I need DMARC for cold email?

Yes. While DMARC is not legally required, it is a best practice that improves deliverability. Receiving servers give higher trust to domains with properly configured DMARC.

Can I skip the monitoring phase?

You can move quickly if your SPF and DKIM are verified and working, but monitoring for at least 2 weeks is strongly recommended to catch any edge cases.