In this article9 sections
To take a business domain from no DMARC to p=reject without losing real mail, do it in four stages over about four weeks: publish p=none with a reporting address and change nothing else; use the reports to list every service that sends as your domain and fix each one; move to p=quarantine for a share of mail and then all of it; and switch to p=reject only after two clean weeks. The record itself takes two minutes. The four weeks are for finding the senders you forgot about, such as the website’s contact form and the invoicing tool.
This guide is for a small business with one domain, a few mailboxes and a handful of services that send email on its behalf. You need access to the domain’s DNS. If you are not sure where that is, see how DNS and nameservers work.
What the three records do
- SPF is a list, published in DNS, of the servers allowed to send mail for your domain.
- DKIM is a signature each sending service adds to a message, which receivers check against a public key in your DNS.
- DMARC tells receivers what to do when a message passes neither test for your domain, and where to send reports.
The phrase “for your domain” is the part most guides skip, and it is called alignment. A message passes DMARC only if SPF or DKIM passes and the domain that passed matches the domain in the From line your customer sees. A newsletter tool that signs with its own domain passes DKIM and still fails DMARC for yours. Almost every problem during a rollout is an alignment problem.
Week 1: Publish p=none and start collecting reports
Add one TXT record. It changes nothing about how your mail is delivered:
| Type | Name | Value |
|---|---|---|
| TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:[email protected] |
Create the dmarc@ address first, as a mailbox or an alias. Check the record from any computer:
dig +short TXT _dmarc.example.comWithin a day or two, Google, Microsoft, Yahoo and others start sending a daily report to that address. Each is a compressed XML file listing which servers sent mail claiming to be from your domain, how many messages, and whether SPF and DKIM passed and aligned.
Tip. The XML is hard to read by eye. Point rua at a free DMARC report viewer instead of a mailbox, or forward the reports to one. It turns the files into a table of senders with pass and fail counts, which is all you need.
Week 2: List every sender and fix each one
Go through the reports and write down every source. A typical small business finds five to eight:
| Sender | Typical result at first | Fix |
|---|---|---|
| Your mailboxes (email host) | Pass | Nothing, if SPF and DKIM were set up with the mailboxes |
| Website contact form or shop emails | Fail | Send through SMTP with a real mailbox, not PHP mail() |
| Newsletter tool | DKIM passes, not aligned | Complete the tool’s “authenticate your domain” step (adds CNAME records) |
| Invoicing, CRM or helpdesk | Fail or not aligned | Add its DKIM records; add its include: to SPF if it asks |
| Forwarded mail | SPF fails, DKIM passes | Nothing: this is why DKIM matters |
| Unknown servers abroad | Fail | Nothing: this is the spoofing DMARC will block |
Fix SPF
You may publish only one SPF record. Two records is an error, and receivers treat it as a failure. Combine every sender into one:
v=spf1 include:_spf.your-email-host.example include:servers.newsletter-tool.example ~allSPF also allows at most ten DNS lookups, and every include: costs at least one. A record that exceeds ten fails for everyone. If you are near the limit, remove services you no longer use before adding new ones.
Fix DKIM
Each service gives you one or two records to add under a name like selector._domainkey. Add them exactly as given. Then send yourself a test message from that service, open the message source in Gmail (“Show original”) and look for:
dkim=pass [email protected]
spf=pass smtp.mailfrom=example.com
dmarc=pass header.from=example.comdmarc=pass is the line that matters. If DKIM passes with the service’s domain instead of yours, alignment is missing and that service’s domain setup is not finished.
Week 3: Move to quarantine, a part at a time
When the reports show every legitimate sender passing for several days in a row, change the record so a quarter of failing mail goes to spam folders:
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]Watch for two or three days. Ask colleagues whether anything they expected went missing, and check the reports for a legitimate source you had not seen before. If all is quiet, raise pct to 100 or remove it.
Week 4: Reject
After a week or two at full quarantine with clean reports:
v=DMARC1; p=reject; rua=mailto:[email protected]Receivers now refuse mail that claims to be from your domain and fails. Someone forging your address to send fake invoices to your customers gets nowhere. Keep the reporting address: a new tool added next year will show up there as failures, before anyone complains.
Warning. Do not start at p=reject. With an unfinished sender list, the mail you lose first is the kind nobody notices is missing: order confirmations, password resets and form enquiries from your website.
Subdomains and domains that send no mail
The policy applies to subdomains too, unless you add sp= with a different one. If a tool sends from news.example.com, authenticate that subdomain as well before you reach reject.
For a domain you own but never send from, such as a parked name or an old brand, publish the strictest setting on day one. There are no senders to break:
example.net TXT "v=spf1 -all"
_dmarc.example.net TXT "v=DMARC1; p=reject"Common mistakes to avoid
- Two SPF records. Merge them into one.
- More than ten SPF lookups. The record fails silently for every sender.
- Stopping at
p=none. It reports but protects nothing. Many domains are left there for years. - Forgetting the website. Contact forms and shop notifications are the senders most often missed.
- Ending SPF with
+all. That allows the whole internet to send as you. Use~allor-all. - Relying on SPF alone. SPF breaks when mail is forwarded. DKIM survives forwarding, so get DKIM aligned for every sender.
Email on your own domain, set up correctly
With SiteHarbour business email, our team adds the MX, SPF, DKIM and DMARC records for your domain when your mailboxes are created, and can move existing mail from your current provider. That covers the mailboxes themselves. The other services that send as your domain still need the steps above, and this rollout is how you find them.
Frequently asked questions
Do I need DMARC if I send very little email?
Yes. Gmail and Yahoo require SPF or DKIM from every sender, and DMARC from anyone sending in bulk. More to the point, without an enforced policy anyone can send mail that appears to come from your address.
How long should each stage last?
Long enough to see every regular sender at least once. Monthly invoices or a monthly newsletter mean you should watch for a full month before reject.
Will DMARC stop spam arriving in my inbox?
No. It stops others from sending mail that pretends to be from your domain. Incoming spam is handled by your mail host’s filtering.
What does pct do?
It applies the policy to that percentage of failing messages and treats the rest under the next weaker policy. It is a way to move gradually; remove it once you are confident.
Why did a message pass SPF and DKIM but fail DMARC?
Alignment. Both passed for a domain other than the one in the From line, usually the sending service’s own. Finish that service’s domain authentication so it signs as your domain.
The short version: publish p=none today, spend two weeks making every real sender pass with your domain, step through quarantine, and finish at reject. The record is easy; the sender list is the work.