How to deploy DMARC for your domain
A step-by-step for standing up SPF, DKIM, and DMARC so attackers cannot spoof your domain — start in monitoring mode, read the reports, then tighten to enforcement.
DMARC stops spoofing — roll it out gradually
DMARC builds on SPF and DKIM to tell receiving mail servers what to do with mail that fails authentication for your domain. Deploy it in stages: publish SPF and DKIM, publish a DMARC record at p=none to just monitor, read the reports to fix legitimate senders, then move to p=quarantine and finally p=reject. Rushing to reject before you understand your senders will drop real mail.
Steps
- **1. Inventory your senders.** List every service that sends mail as your domain (your mail platform, marketing tools, ticketing, invoicing). You cannot authenticate senders you do not know about.
- **2. Publish SPF.** Add a DNS TXT record listing the servers authorized to send for your domain. Keep it within the DNS lookup limit and avoid a catch-all that authorizes everyone.
- **3. Enable DKIM.** Turn on DKIM signing at each sending service and publish the public keys they give you as DNS records, so receivers can verify messages are unaltered and truly from you.
- **4. Publish DMARC at p=none.** Add a _dmarc TXT record with policy none and an rua address to receive aggregate reports. This monitors without affecting delivery.
- **5. Read the aggregate reports.** Use the reports to find every legitimate sender and confirm each passes SPF and/or DKIM with alignment. Fix the gaps.
- **6. Move to p=quarantine.** Once legitimate mail passes, raise the policy so failing mail goes to spam. Watch the reports.
- **7. Move to p=reject.** When you are confident, set the policy to reject so spoofed mail is refused outright. This is the goal state.
Alignment is what makes DMARC strong
DMARC requires that the domain that passed SPF or DKIM aligns with the visible From domain. That alignment is what a spoofer cannot fake. When configuring senders, make sure they can sign with — or send from — your actual domain, not just some provider domain, or they will pass SPF/DKIM but fail DMARC alignment.
Do not jump straight to p=reject
Publishing p=reject before you have mapped your senders is the fastest way to silently drop legitimate invoices, password resets, and marketing mail. Always spend real time at p=none reading reports first. The staged rollout exists precisely because most organizations discover senders they had forgotten.