How to Set Up DMARC: Records, Policies and Reports, Step by Step

To set up DMARC, list every service that sends mail as your domain, make each one pass SPF or DKIM with your own domain, then publish a TXT record at _dmarc.yourdomain such as v=DMARC1; p=none; rua=mailto:reports@yourdomain. Read the daily aggregate reports, fix the senders that fail, and only then move to p=quarantine and p=reject.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS TXT record that tells receiving mail servers what the owner of a domain wants done with mail that fails authentication, and where to send reports about it. A message passes DMARC when SPF or DKIM passes for a domain that aligns with the domain in the visible From address.

The standard changed this year: in May 2026 the IETF published RFC 9989, which obsoletes RFC 7489, the version Microsoft's and Yahoo's pages still cite. If mail from a cPanel server already lands in spam, start with my cPanel email going to spam guide. This guide is the DMARC rollout itself.

How does DMARC work with SPF and DKIM?

DMARC adds one check on top of SPF and DKIM: the domain they authenticate must match the domain in the From header. RFC 9989 calls this identifier alignment. Without it, SPF and DKIM can pass for a domain your recipient never sees.

Relaxed alignment, the default, accepts the same organizational domain, so bounces.example.com aligns with example.com. Strict needs an identical name. RFC 9989 says "nearly all Domain Owners have found relaxed alignment sufficient," and Yahoo says "Relaxed alignment is acceptable." I keep both modes relaxed unless someone else runs a subdomain.

How do you set up DMARC, step by step?

Follow the order in RFC 9989 Section 5.1: SPF, DKIM, a reports mailbox, a p=none record, then analysis and fixes before any enforcement.

1. Inventory every sender: mailbox provider, website forms, billing or WHMCS invoices, newsletter tool, help desk, CRM. Anything that puts your domain in the From line counts.
2. Set up aligned SPF and DKIM on each one. One SPF record covering your servers and each service's include, and DKIM signing with your domain wherever offered. Google says to "Allow 48 hours after setting up SPF and/or DKIM before setting up DMARC."
3. Create a reports mailbox or group, not a person's inbox. Google warns large organizations can get "hundreds or even thousands of reports daily."
4. Publish p=none with rua. Receivers deliver as before and send you reports.
5. Fix every legitimate stream that fails. RFC 9989 says this "MUST be addressed" before enforcement and that it "may take many months" for some senders.
6. Move to p=quarantine, so failing mail goes to spam, and keep reading reports.
7. Move to p=reject when nothing legitimate fails. Section 7.4 says a domain at reject "MUST apply valid DKIM signatures" and must not rely on SPF alone.

Google's recommended rollout suggests p=none "for one week" before quarantine. I wait for a full monthly cycle of reports, because monthly invoices and newsletters only appear once a month. When a new service starts sending as your domain, it goes back to step 1.

What does a DMARC record look like?

It is one TXT record at _dmarc under the From domain. The record for each stage, with example.com in place of your domain:

; 1. Monitoring: no policy, reports on
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; 2. First enforcement step
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

; 3. Full enforcement, softer rule for subdomains still in progress
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com"

; 4. A domain that never sends mail (Microsoft's parked-domain record)
_dmarc.example.net.  TXT  "v=DMARC1; p=reject;"

; 5. Published by reports.example.org to accept example.com's reports
example.com._report._dmarc.reports.example.org.  TXT  "v=DMARC1;"

Record 5 matters when rua points to another domain, such as a reporting service: RFC 9990 tells receivers to ignore the address if it is missing. The tags, as RFC 9989 defines them:

Should you still use pct for a gradual rollout?

Not as your main tool. RFC 9989 removed it because "Operational experience showed that the 'pct' tag was usually not accurately applied, unless the value specified was either 0 or 100." It also dropped rf and ri. Google's Set up DMARC page still recommends pct, and Microsoft's still steps from pct=10 to pct=100; receivers ignore tags they do not know, so a leftover one breaks nothing. I move the whole domain one policy at a time, and test enforcement on a low-volume subdomain first, as Microsoft also recommends.

How do you set up DMARC in Google Workspace, Microsoft 365 and cPanel?

In all three, the DMARC record lives at your DNS host. What differs is where SPF and DKIM are switched on.

Sources: Google's Set up DMARC, Microsoft's Set up DMARC to validate email in Microsoft 365 and cPanel's Email Deliverability page. On cPanel, the hosting provider must enable Email Deliverability in WHM's Feature Manager. Customers with outside DNS cannot repair records from cPanel, so hosting companies should hand them the suggested values.

What do Gmail, Yahoo and Outlook.com require from bulk senders?

All three require SPF, DKIM and a DMARC record of at least p=none, aligned with SPF or DKIM. They differ on who counts as bulk and on what happens to failing mail.

Sources: Google's Email sender guidelines and FAQ, Yahoo's Sender Best Practices and FAQ, and Microsoft's Outlook.com high-volume sender post (hotmail.com, live.com and outlook.com addresses). Google's FAQ adds that "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic," and that "DMARC alignment with both SPF and DKIM will eventually be a sender requirement," so I align both now. Spam-rate and unsubscribe rules are summarized in my cPanel spam guide.

How do you read DMARC aggregate reports?

Aggregate reports are XML files, usually gzip-compressed and sent once a day; RFC 9990 says each typically covers "a single UTC day." Each record gives a sending IP (source_ip), a message count, the disposition applied, the DMARC dkim and spf alignment results, the header_from and envelope_from domains, and the raw SPF and DKIM results. Google and Microsoft suggest a reporting service or a parser. The patterns to act on, adapted from Microsoft's report table:

Why does DMARC fail, and what are the common mistakes?

DMARC fails when no SPF or DKIM pass aligns with the From domain. Take one failing message or report row and answer these in order:

1. Was it forwarded or sent through a mailing list? SPF usually fails there, while DKIM signatures "will generally remain valid," per RFC 9989. Yahoo and Microsoft recommend ARC for forwarders.
2. Does SPF or DKIM pass at all? If not, fix the SPF record or turn on DKIM.
3. Does the passing domain share the From domain's root domain? If not, sign DKIM with your own domain at that service.
4. Is alignment strict? Then names must match exactly. If relaxed, DMARC passes.

The setup mistakes behind most of these answers:

• Two SPF records. RFC 7208 returns "permerror" when more than one v=spf1 record exists. Merge them.
• Too many SPF lookups. More than 10 include, a, mx, ptr, exists or redirect terms also gives permerror.
• Two DMARC records. RFC 9989: "If multiple DMARC Policy Records are returned for a single target, they are all discarded."
• Unaligned third-party senders. SPF passes for the vendor's bounce domain and DKIM signs as the vendor, so DMARC fails although both show pass.
• Subdomain surprises. Microsoft notes a domain's record covers all subdomains, even nonexistent ones, unless a subdomain has its own record. Set sp and np on purpose.
• Reject where staff post to mailing lists. RFC 9989 says such domains "SHOULD NOT" publish p=reject, or should first spend at least a month at none and as long at quarantine. I move bulk and transactional mail to a subdomain and decide on the main domain separately.

Securing the servers that send as your domain is the other half; I cover it in server security hardening.

What is the DMARC setup checklist?

• Every sending service listed, with someone who can change its settings.
• One SPF record, within 10 lookup terms, covering every sender.
• DKIM signing with your domain everywhere; Google and Yahoo require at least 1024-bit keys and recommend 2048.
• A dedicated reports mailbox, plus the _report._dmarc record if reports go to another domain.
• Exactly one _dmarc record, v=DMARC1 first, starting at p=none with rua.
• Reports read over at least one monthly cycle until every real stream passes.
• Quarantine, then reject, still reading reports after each change.
• Parked domains at p=reject.

What else do people ask about DMARC setup?

How long should I stay at p=none?

Until the reports show every legitimate sender passing. Google suggests at least a week; RFC 9989 says it "may take many months" depending on how often you send. I wait for at least one monthly cycle.

Can a domain have two DMARC records?

No. Under RFC 9989, receivers discard all of them, so the domain behaves as if it had none. Put several report addresses in one rua tag, separated by commas.

Does p=none protect my domain from spoofing?

No. RFC 9989 defines none as "no expression of preference," so receivers treat failing mail as usual. It gives you reports and meets the bulk-sender minimum; protection starts at quarantine.

Do subdomains need their own DMARC record?

Not usually. The parent record applies unless sp, np or a subdomain's own record says otherwise. Each subdomain that sends mail still needs its own SPF and DKIM, as Microsoft points out.

Do I need DMARC if I send fewer than 5,000 emails a day?

Below the bulk line, Gmail asks only for SPF or DKIM as authentication, but Google recommends you "always set up SPF, DKIM, and DMARC," and Yahoo "strongly urges" a DMARC policy for each sending domain. Without one, nothing asks receivers to block mail that spoofs you.

If you want someone to inventory your senders, fix alignment and take your domains to reject without losing real mail, I do this as part of my hosting infrastructure consulting.

Last reviewed 26 October 2026. Disclosure: I sell hosting infrastructure and mail setup work, so I am not neutral. I am CTO at ElySpace, a hosting company, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI. I am not affiliated with Google, Microsoft, Yahoo or cPanel. Rules and tags are as the linked pages stated on that date.