DMARC is one TXT record. The work is not publishing it — that takes five minutes — it is reading the reports and authenticating the senders they expose.
SPF and DKIM must already be working. DMARC only tells receivers what to do when both fail; publishing it first just produces noise. Verify both here.
| Type | TXT |
|---|---|
| Name | _dmarc (i.e. _dmarc.example.com) |
| Value | v=DMARC1; p=none; rua=mailto:[email protected]; fo=1 |
| TTL | 3600 |
Some DNS panels want the full name _dmarc.example.com instead of just
_dmarc. If your record ends up at _dmarc.example.com.example.com, that
is the mistake.
v=DMARC1 — required, must be first.p= — policy: none, quarantine or
reject.rua= — where daily aggregate XML reports go. The one tag that makes DMARC
useful.ruf= — forensic reports. Rarely sent, and they can contain recipient
data — usually skip it.pct= — apply the policy to N% of failing mail. Your ramp control.sp= — a different policy for subdomains. Set sp=reject on a
domain that never sends from subdomains.adkim= / aspf= — alignment strictness, r
(relaxed, default) or s (strict). Leave relaxed.fo=1 — report on any failure, not only total failure.To send reports to an address outside the domain, the receiving domain must authorise
it with a TXT record at
example.com._report._dmarc.reports-vendor.com containing
v=DMARC1. Skip this and your reports are silently dropped.
Aggregate reports are gzipped XML, one per receiver per day. Each row is a source IP with a count and SPF/DKIM pass-fail. You are looking for sources you do not recognise that are sending real mail — those are the systems you forgot to authenticate. Feed them to any DMARC report parser rather than reading raw XML.
Once every legitimate source passes and aligns, move to p=quarantine; pct=25, ramp
to 100, then p=reject. Full sequence:
policy rollout →
MailGate — free SPF, DKIM & DMARC checker. Check any domain →