Set up DMARC without blocking legitimate email
Set up DMARC safely: observe first, enforce second.
Creating the TXT record is easy. The risky part is moving to quarantine or reject before every legitimate sender is aligned. This sequence keeps the rollout measurable and controlled.
Reviewed: July 19, 2026 · Primary sources below
Inventory every legitimate sender
List Microsoft 365 or Google Workspace plus newsletters, invoicing tools, CRM, ticketing, website forms, scanners, and third-party services. A forgotten sender can fail once enforcement starts.
Stabilize SPF and DKIM first
DMARC needs aligned SPF or aligned DKIM to pass. Configure both where possible and verify real delivered messages, not only DNS records. Google recommends having SPF and DKIM in place for at least 48 hours before enabling DMARC.
Start in monitoring mode
Publish p=none with a working aggregate-report address. Receivers can report authentication results, but your policy does not yet ask them to quarantine or reject failures.
v=DMARC1; p=none; rua=mailto:dmarc@example.comObserve a representative period
Map each relevant source to a legitimate system or abuse. Google recommends at least one week as a typical starting point; monthly billing or campaign tools may require longer.
Fix the sender, not the symptom
Correct SPF, enable provider DKIM, or use an aligned From domain. Broad exceptions hide configuration errors and weaken the policy you are trying to deploy.
Move to enforcement gradually
Use quarantine before reject and increase enforcement only after legitimate sources consistently align. Continue watching aggregate reports because receivers retain their own delivery decisions.
Free RFC 9989 generator
Build the exact DMARC DNS record safely.
Generate a monitoring, quarantine, or reject policy with a reporting address, DNS-ready output, and an external-reporting warning. No obsolete pct tag.
Important
A high MX Audit score is not approval to publish p=reject.
The browser check sees public DNS signals, not every platform that actually sends for your domain. Real message headers and aggregate reports remain the deciding evidence. Only change enforcement with DNS access and a complete sender inventory.
If you need continuous monitoring
See who really sends in your name.
DMARCTrust is an external platform for DMARC reports, alerts, and sender inventory. Its free evaluation tier is limited to one domain; paid business plans start at $19/month for two domains. The MX Audit score remains independent.
Do I need both SPF and DKIM?
DMARC can pass when either SPF or DKIM passes and aligns with the visible From domain. In practice, professional environments should operate both because forwarding can break SPF and different services sign mail differently.
What does p=none mean?
It is monitoring mode. Receivers can evaluate DMARC and send reports, but the published policy does not ask them to quarantine or reject failed messages.
How long should monitoring run?
Google names at least one week as a typical baseline. Seasonal billing, newsletter, or campaign systems can justify a longer observation period.
Where do I publish DMARC?
Publish a TXT record at _dmarc for your domain with the DNS host. For a custom domain, this is normally managed at the DNS provider rather than inside Microsoft 365 or Google Workspace.