How to Set Up DMARC
A safe, step-by-step DMARC rollout: start at p=none, read the reports, then move to quarantine and reject — without blocking your own email.
By the ToolsHub team · Updated May 1, 2026
DMARC is powerful but easy to get wrong — enforce too fast and you block your own mail. The safe approach is a phased rollout. Build your record with the DMARC Record Generator and follow these stages.
1. Start at p=none (monitor)
Publish a record with p=none and an rua reporting address, as a TXT record on the host _dmarc. Nothing is blocked yet — you're only asking receivers to report what they see. Leave it running for two to four weeks.
2. Read the reports
Aggregate reports arrive as XML, which is unreadable by hand — drop them into our DMARC Report Viewer to see every server sending as your domain and whether it passes SPF and DKIM. Expect surprises: invoicing tools, CRMs and marketing platforms often send on your behalf. Authorise each legitimate one in SPF or set up DKIM for it.
3. Move to quarantine, then reject
Once your legitimate mail passes cleanly, change the policy to p=quarantine (failures go to spam), monitor for a while longer, then finally p=reject (failures are refused). Reject is the goal — it's what actually stops spoofing. Verify each change with the DMARC Checker.
Reading your DMARC reports
The real value of DMARC comes after you publish it, from the aggregate reports receivers send back. These daily XML files list every source that sent mail claiming to be your domain and whether it passed SPF and DKIM — revealing both legitimate services you forgot and impostors spoofing you.
Raw DMARC XML is hard to read, so paste it into our DMARC Report Viewer to see it as a clear table. Watch for a week or two at p=none, make sure every legitimate sender passes, then move to quarantine and finally reject to shut spoofing down. You can build or adjust the record anytime with our DMARC Record Generator.
Frequently asked questions
- How do I set up DMARC?
- Publish a TXT record at _dmarc.yourdomain.com with a policy, starting at p=none to monitor. Our DMARC Record Generator builds the record and our checker verifies it.
- What do p=none, quarantine and reject mean?
- They're DMARC policies: none only monitors, quarantine sends failing mail to spam, and reject blocks it outright. Move from none to quarantine to reject as confidence grows.
- Should I start with p=reject?
- No. Start with p=none to collect reports and confirm your legitimate mail passes, or you risk blocking real messages. Tighten to quarantine then reject once the reports look clean.
- What are DMARC aggregate reports?
- Daily XML summaries from receivers showing which sources sent mail as your domain and whether it passed. Our DMARC Report Viewer turns that XML into a readable table.