How do I start implementing DMARC (p=none)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
So Start with p=none. That's the unanimous advice from everyone who works with DMARC seriously, and the reasoning is practical: you need to know what's sending email from your domain before you enforce any policy. Skip straight to p=reject and you risk blocking your own legitimate mail.
Step 1: Make sure SPF and DKIM are set up. DMARC needs at least one of them to be passing and aligned. If neither is configured, your DMARC reports won't have much to work with. Check your current authentication status with our free SPF checker and DKIM checker before going further.
Step 2: Publish a monitoring record. Add a TXT record at _dmarc.yourdomain.com with:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comUse an email address you'll actually monitor. If that's not practical, a DMARC reporting service that processes XML into readable dashboards is worth considering. Our free DMARC generator can build this record for you.
Step 3: Wait and read reports. Give it two to four weeks. Check the reports. Look for all the sources sending email from your domain: your ESP, your transactional email provider, any internal tools, forwarding services, marketing automation platforms. Each source that's sending needs to be authenticating with aligned SPF or DKIM.
Step 4: Fix alignment issues. Any source showing DMARC failures needs attention. Usually this means configuring DKIM with the right signing domain or updating your SPF record to include the source. Don't move to enforcement until your legitimate sending sources are consistently passing.
Step 5: Move toward enforcement. Once your reports show clean authentication from all your known senders, move to p=quarantine, watch for a week or two, then move to p=reject.
The whole process typically takes four to eight weeks for a domain with a moderate number of sending services. For a simple domain with one ESP, you can often get to p=reject within a few weeks. If you want help reading your reports and understanding what to fix, the SOS hotline is free.
For context on the three DMARC policy levels and what each one means, see the full policy guide. For how alignment works, see DMARC alignment modes.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
