How to Implement DMARC

Setting up DMARC is surprisingly quick — you can go from nothing to monitoring in about 5 minutes. The real work happens over the following weeks, as you review reports, sort out any issues, and gradually tighten protection until your domain is fully defended.

Step 1: Work Out Who Sends Email for Your Business

Before you switch on DMARC, take a moment to think about every service and system that sends email using your domain name. You probably have more than you realise:

Make a list. Write down every service that sends email as @yourdomain.com. Don’t worry if you miss some — DMARC reports will show you anything you’ve overlooked once you start monitoring.

Step 2: Set Up Your Authorised Sender List (SPF)

SPF is a list you publish in your domain’s settings (DNS) that tells the world which servers are allowed to send email on your behalf. If you don’t already have one, create an SPF record that includes all your authorised senders:

If you already have an SPF record, use our Domain Checker to make sure it’s correct. Keep an eye on the 10-lookup limit — going over it breaks the whole thing.

Step 3: Set Up Digital Signatures (DKIM)

DKIM adds a digital seal to your emails that proves they haven’t been tampered with and genuinely came from your domain. Enable DKIM for each of your email services — this is usually done in the service’s admin panel. They’ll give you a record to add to your domain’s settings (DNS). See our DKIM setup guide for provider-by-provider instructions.

Step 4: Publish Your DMARC Record

This is the main event. DMARC ties SPF and DKIM together and tells the world what to do when an email fails these checks. Use our DMARC Record Generator to create your record. For your first setup, start with:

Add this as a TXT record in your domain’s settings (DNS) at _dmarc.yourdomain.com.

Step 5: Review Your Reports

Within a day or two of publishing your DMARC record, you’ll start receiving reports. These reports show you:

• Every server that sent email claiming to be from your domain
• Whether each sender passed or failed your SPF and DKIM checks
• Whether the checks matched up with the “From” address your recipients see (this matching is called “alignment”)
• How many emails each source sent

The raw reports are in a machine-readable format (XML), which is where DMARC Cloud comes in — we turn them into clear dashboards so you can instantly see:

Step 6: Fix Any Problems

For any legitimate senders that are failing, here’s what to do:

1. Add the service to your authorised sender list (SPF record)
2. Turn on digital signatures (DKIM) in the service’s settings
3. Make sure the “From” address they use matches your domain — this matching is what DMARC actually checks (it’s called “alignment”)

Common fixes:

• A third-party service fails your sender list check → Add their include: to your SPF record
• A service fails the digital signature check → Turn on DKIM signing in their settings and publish the record they give you
• The “From” address doesn’t match → Configure the service to send using your domain name in the “From” field, not theirs

Step 7: Tighten Your Protection

Once your reports show that all your legitimate senders are passing, it’s time to start blocking the fakes. Do this gradually — think of it as turning up a dial, not flipping a switch:

Quick-Start Checklist