Setup guide
DMARC rollout

DMARC rollout: from p=none to enforcement without breaking your mail

DMARC is the DNS record that tells receivers what to do when mail claiming to be from your domain fails authentication. Set it to reject on day one and any sending system you forgot about gets silently discarded. The safe path is phased, and each phase has a specific exit condition.

Phase 1: monitor

Publish a monitoring-only record:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1; ri=86400

Add it as a TXT record at the host _dmarc (so the full name is _dmarc.yourdomain.com). Nothing is enforced. Aggregate reports arrive once a day from Gmail, Outlook and every major receiver, telling you every sending source seen using your domain, and whether each passed SPF and DKIM alignment.

What the parts do:

p=none - monitor only. Report, but deliver as before.
rua - where aggregate reports go. Must be a mailbox that exists. If it points at a different domain than the one publishing the record, that domain must authorize yours with an extra DNS record, which is why keeping it same-domain is simpler.
fo=1 - also send failure reports when either mechanism fails, not just both.
ri=86400 - report interval: daily.

Stay in this phase for two to four weeks. You are building the inventory of everything that sends as your domain: the mail platform you know about, the CRM you forgot, the printer that emails scans, the forwarding rule a former employee set up.

The exit condition for phase 1

Reports show every legitimate source passing SPF or DKIM alignment, and everything failing alignment is either internal mail you have now fixed or outside spoofing you want blocked. If some legitimate source keeps failing, fix that first: enable DKIM in the sending platform, or correct the From address it uses. Do not escalate past unexplained failures.

Phase 2: quarantine, ramped

Once the evidence is clean:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com; fo=1; ri=86400

Failing mail now lands in spam folders for 25% of messages. Step to 50, then 100, a few days to a week apart, reading reports between steps. The ramp exists so that a mistake affects a quarter of your mail instead of all of it, and so you can watch quarantine counts climb on mail you do not recognize.

The exit condition for the phase: reports at pct=100 show zero legitimate sources being quarantined, sustained over one to two weeks.

Phase 3: reject

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; fo=1; ri=86400

Spoofed mail is now refused outright at receiving servers. Keep reading the reports: they are your permanent record of who is trying to impersonate you, and they will also show any new legitimate system someone in your company signs up for without telling you.

Common mistakes

Starting at p=reject. Every forgotten sender is instantly discarded, including order confirmations and invoice mail. There is no upside to skipping the monitoring phase.
rua pointing at a mailbox nobody reads. The reports are the entire point of p=none. An unread report address is a DMARC project that never escalates.
Escalating while SPF passes but alignment fails. SPF passes for the bounce domain, not the From domain. Unless alignment passes, DMARC does not care that SPF was green. This is the most common reason a "working" setup fails DMARC.
Records at both the root and _dmarc. The DMARC record lives at _dmarc.yourdomain.com only. A copy at the root does nothing but confuse.
Subdomains unmonitored. Receivers fall back to the organizational domain's policy, but if you have distinct sending subdomains, check their alignment in the reports explicitly.

How to check your record landed

dig TXT _dmarc.yourdomain.com +short

You want exactly one string starting with v=DMARC1. Reports start arriving within about a day of the record resolving.

This phased path is exactly what our remediation protocol implements for your domain, with the records written for your specific registrar and sending setup, plus verification that each record landed. Email your domain to hello@authpulse.io for a free scan and we will tell you which phase your domain is ready for.