Build a DMARC record,and the ramp to enforce it.
DMARC tells the world what to do with mail that fakes your domain. This builds a valid _dmarc TXT record from your policy, reporting, and alignment choices, then shows you the safe path from monitoring to full enforcement, so you stop spoofers without blocking your own newsletters.
Your DMARC policy
Your DMARC record
Host / name
_dmarc.yourdomain.com
TXT value
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Replace yourdomain.com with your real domain, then add this as a TXT record in your DNS.
Before you publish
Monitoring only
Not protecting anything yet — collect reports, then move to quarantine.
Your move
A clean DMARC record is one piece. I make sure your mail actually lands.
This record monitors silently and collects the reports that tell you who is sending as your domain — the safe first rung.
Deliverability is SPF, DKIM, DMARC, domain reputation, and the content of the email all working together. Generate your record here, then bring me your sending setup and I'll tell you, free, what's keeping you out of the inbox and what I'd fix first.
Plain English
DMARC is the verdict on spoofed mail.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a published TXT record at _dmarc.yourdomain.com that tells receiving servers what to do when a message claims to be from your domain but fails authentication. It builds on top of SPF and DKIM: those two prove a message is legitimately yours, and DMARC decides what happens to the ones that can't prove it, plus it sends you reports on every sender using your name.
Without DMARC, anyone can put your domain in the From line and mailbox providers will mostly let it through. That is how phishing and brand impersonation work. With DMARC set to enforce, a spoofed message gets quarantined or rejected before it ever reaches the inbox, and you get the reports that show exactly who is sending as you, legitimately or not.
The catch is that flipping straight to reject without doing the homework can bounce your own mail: a forgotten SaaS sender, an unaligned subdomain, a marketing platform you never authorized. That is why DMARC is a ramp, not a switch. You start in monitor mode, read the reports, fix the gaps, then tighten the policy in stages. This tool builds the record for whichever stage you are on.
The formula
_dmarc TXT = v=DMARC1; p=<policy>; rua=mailto:<inbox>; (pct, ruf, adkim, aspf, sp as needed)
A monitoring record reads v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com — it blocks nothing but collects reports. A full-enforcement record reads v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s — spoofed mail is rejected and alignment is strict. Same domain, two ends of the ramp.
The none → quarantine → reject ramp
Never start at reject. Move one rung at a time, watching your aggregate (rua) reports at each stage. A typical rollout uses pct to enforce on a slice of mail before going to 100%:
| Stage | Policy | pct | What it does |
|---|---|---|---|
| 1. Monitor | p=none | 100% | Blocks nothing; collects reports |
| 2. Quarantine (slice) | p=quarantine | 25% | Spam-folders a quarter of failures |
| 3. Quarantine (full) | p=quarantine | 100% | Spam-folders all failing mail |
| 4. Enforce | p=reject | 100% | Bounces all spoofed mail outright |
Source: DMARC.org / RFC 7489 deployment guidance · 2025
Your DMARC isn't doing what you think. Here's why.
You published p=none and called it done.
p=none protects nothing — it only collects reports. It is the starting line, not the finish. Read a few weeks of rua data, fix every failing legitimate sender, then move to p=quarantine.
You jumped straight to p=reject.
If any legitimate sender wasn't aligned, that mail is now being rejected and you may not find out until a customer complains. Drop back to quarantine (or use pct to enforce on a slice), confirm reports are clean, then re-enforce.
DMARC passes but spoofing still gets through.
Check alignment. A message can pass SPF or DKIM on a different domain than the one in the From line and still fail DMARC alignment. Tighten adkim/aspf to strict only once your own mail is properly aligned.
You have no rua address.
Without a reporting inbox you are enforcing blind — you can't see who is sending as you or what would break. Always set rua before you tighten the policy past none.
How to roll out DMARC without breaking mail
01Get SPF and DKIM passing first
DMARC only acts on the results of SPF and DKIM. If those aren't set up and aligned for every sender, DMARC has nothing solid to judge against. Fix authentication before you publish a policy.
02Start at p=none
Monitor mode publishes the record and turns on reporting without affecting delivery. Let it run for two to four weeks so you capture every sender, including the quarterly ones.
03Read the aggregate reports
The rua feed shows every IP sending as your domain and whether it passed. Use a parser or DMARC dashboard — raw XML is unreadable. Find your legitimate-but-failing senders here.
04Fix unaligned senders
For each legitimate sender that fails, add it to SPF, set up DKIM signing, or use a custom return-path so it aligns. Don't move to enforcement until the reports are clean.
05Move to quarantine with pct
Set p=quarantine and start at pct=25, then 50, then 100. This enforces on a sample first, so any surprise sender only affects a fraction of mail while you catch it.
06Then go to p=reject
Once quarantine at pct=100 is clean for a couple of weeks, switch to p=reject. Now spoofed mail is bounced outright and you have the strongest protection DMARC offers.
07Set a subdomain policy
Use sp to control mail from subdomains separately. A common pattern is a strict p=reject on the root but a looser sp while you onboard subdomain senders — or sp=reject to lock everything down at once.
08Decide on alignment mode
Relaxed (r) matches the organizational domain and is the safe default. Strict (s) requires an exact domain match — only flip to strict once you've confirmed every sender aligns exactly.
09Skip ruf unless you need it
Forensic (ruf) reports send per-message failure samples and are verbose, privacy-sensitive, and ignored by many providers. Most rollouts run on rua alone.
10Re-check after every new sender
Each new ESP, CRM, or invoicing tool that sends as you is a new alignment risk. Add it, confirm it passes in the reports, then carry on. DMARC is maintained, not set-and-forget.
The vocabulary
- DMARC
- A policy record (v=DMARC1) at _dmarc.yourdomain.com telling receivers what to do with mail that fails SPF/DKIM alignment, plus where to send reports.
- p (policy)
- The action for failing mail: none (monitor), quarantine (spam folder), or reject (bounce it). This is the main dial.
- pct
- The percentage of failing mail the policy applies to. Used to roll out enforcement gradually, e.g. pct=25 before pct=100.
- rua / ruf
- Reporting addresses. rua receives daily aggregate reports (essential); ruf receives forensic per-message samples (optional, verbose).
- Alignment (adkim / aspf)
- Whether the authenticated domain must match the From domain. Relaxed (r) allows the org domain; strict (s) requires an exact match.
- sp
- Subdomain policy — the action applied to mail from subdomains, set independently of the root domain's p value.
DMARC questions, straight answers
It's a single TXT record published in your DNS at the host _dmarc.yourdomain.com (replace yourdomain.com with your real domain). The value starts with v=DMARC1 and lists your policy and reporting addresses. Add it like any other TXT record at your DNS provider, then let aggregate reports start flowing.
Keep going
A calculator tells you what. A call tells you what to do about it.
Send me the account behind these numbers. I'll tell you straight where the money's leaking and what I'd fix first — free, and you keep it whether you hire me or not.