How to Set Up DMARC
A safe, step-by-step DMARC rollout: start at p=none, read the reports, then move to quarantine and reject — without blocking your own email.
By the ToolsHub team · Updated May 1, 2026
DMARC is powerful but easy to get wrong — enforce too fast and you block your own mail. The safe approach is a phased rollout. Build your record with the DMARC Record Generator and follow these stages.
1. Start at p=none (monitor)
Publish a record with p=none and an rua reporting address, as a TXT record on the host _dmarc. Nothing is blocked yet — you're only asking receivers to report what they see. Leave it running for two to four weeks.
2. Read the reports
Aggregate reports arrive as XML, which is unreadable by hand — drop them into our DMARC Report Viewer to see every server sending as your domain and whether it passes SPF and DKIM. Expect surprises: invoicing tools, CRMs and marketing platforms often send on your behalf. Authorise each legitimate one in SPF or set up DKIM for it.
3. Move to quarantine, then reject
Once your legitimate mail passes cleanly, change the policy to p=quarantine (failures go to spam), monitor for a while longer, then finally p=reject (failures are refused). Reject is the goal — it's what actually stops spoofing. Verify each change with the DMARC Checker.