Quick answer
How do I set up DMARC for my domain?
Publish a TXT record at _dmarc.yourdomain that reads v=DMARC1; p=none; rua=mailto:you@yourdomain, read the aggregate reports for about a month, then raise the policy to quarantine and finally reject. DMARC is defined by RFC 9989 since May 2026. Postelva hosts the record in its free DNS editor.
The three DMARC policies and what each one does
| Policy | Record | Effect on a message that fails DMARC | When to use it |
|---|---|---|---|
| Monitor | v=DMARC1; p=none; rua=mailto:[email protected] | Delivered as usual; reports are sent to you | First weeks, to see every sender |
| Quarantine | v=DMARC1; p=quarantine; rua=mailto:[email protected] | Treated as suspicious, usually sent to spam | After SPF and DKIM pass on all your legitimate mail |
| Reject | v=DMARC1; p=reject; rua=mailto:[email protected] | Refused by the receiving server | When reports show no legitimate failure left |
Set up DMARC in six steps
Confirm SPF and DKIM first
DMARC needs at least one of them to pass and to match your From domain. Publish both before DMARC, using the guides on SPF and DKIM.
Choose a mailbox for the reports
Create an address such as dmarc@yourdomain. RFC 9989 says the owner must set up a mailbox to receive and analyze aggregate reports.
Publish the monitoring record
Add a TXT record with host _dmarc and the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.
Read the reports for about a month
Reports arrive about once a day from receivers that send them. Look for legitimate mail that fails SPF and DKIM alignment, and fix those senders.
Move to quarantine
Change p=none to p=quarantine. Keep it for a similar period and compare how the messages were handled in the reports.
Move to reject, or stop at quarantine
Change to p=reject when the reports are clean. If you post to mailing lists from this domain, stay at quarantine.
; stage 1: monitor
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
; stage 2: quarantine
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
; stage 3: reject
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"What does a DMARC record contain?
A DMARC record is a TXT record at _dmarc.yourdomain that starts with v=DMARC1 and lists tags separated by semicolons. The version tag comes first and is case-sensitive. RFC 9989 defines these tags: p (policy for the domain), sp (policy for existing subdomains), np (policy for non-existent subdomains), adkim and aspf (alignment, r for relaxed or s for strict, relaxed by default), rua (aggregate report addresses), ruf (failure report addresses), fo (failure options), t (test mode, y or n) and psd.
If p is missing, the receiver treats the policy as none. If sp is missing, the p policy covers subdomains. If rua is missing, no aggregate reports are produced. A minimal useful record therefore has three parts: the version, a policy and a report address.
The pct tag, which many older guides still show, was removed by RFC 9989 because it was rarely applied accurately except at 0 and 100. The t tag replaces it: t=y behaves like pct=0 and t=n like pct=100, and n is the default. Drop pct from old records. The wider background is in SPF vs DKIM vs DMARC.
What does alignment mean in DMARC?
Alignment means that the domain authenticated by SPF or DKIM matches the domain in the visible From address. In relaxed mode, the default, the two only need the same organizational domain, so mail.example.com aligns with example.com. In strict mode they must be identical. RFC 9989 notes that nearly all domain owners find relaxed alignment sufficient.
A message passes DMARC when SPF or DKIM passes and is aligned. Either one is enough. A mailbox provider such as Proton Mail or Fastmail signs with your own domain through the DKIM CNAME records, so alignment holds without extra work. The trap is a third-party service that signs with its own domain: its DKIM passes but does not align until you set up a custom signing domain for it.
RFC 9989 finds the organizational domain through a DNS tree walk, with at most eight queries, instead of a public suffix list. For an ordinary domain on a .com or .me this changes nothing you must do.
How long should I stay on p=none?
Stay at p=none for at least a month, then at p=quarantine for a similar period, before p=reject. This is the order RFC 9989 advises in its deployment guidance, and it matches the help pages of the providers. Mailbox.org starts its sample record at p=none and warns that a strict policy set too early can bounce legitimate mail. Proton recommends p=quarantine and a move to p=reject once legitimate mail passes.
According to Postelva's reading of 12 November 2026 of the DMARC guidance of the 3 providers that publish it (Proton Mail, Mailbox.org and Mailfence), 2 start at p=none and 1 recommends p=quarantine.
Two cautions apply to p=reject. RFC 9989 says a domain that uses it must not rely on SPF alone and must sign with DKIM, because SPF breaks on forwarding. It also says that domains whose users post to mailing lists should not publish p=reject at all. Lists often modify messages, which breaks the signature.
Where do DMARC reports go and what do they show?
Aggregate reports go to the mailto: address in rua, usually once a day from each receiver, and list the sources that sent mail with your domain in the From line. RFC 9989 requires receivers to support mailto: addresses and recommends sending aggregate reports at least every 24 hours. Aggregate reporting is defined in RFC 9990.
Failure reports, requested with ruf, are per-message copies. Many receivers withhold or redact them for privacy, so do not count on them. If the rua address sits outside your domain, the owner of that other domain must authorize it with a TXT record at yourdomain._report._dmarc.otherdomain containing v=DMARC1;, a rule that stops abuse of third-party mailboxes. For a small personal domain the list of sources is short: your provider, and little else.
To read what your DNS publishes before and after each stage, use the commands to check MX, SPF, DKIM and DMARC records.
Does my personal domain need DMARC?
Yes, for any domain that sends mail: it costs one TXT record and it blocks forged messages that use your name. Google requires DMARC, with a policy of none being enough, from senders above 5,000 messages a day to Gmail accounts, and Microsoft applies the same threshold to Outlook.com. A personal mailbox sits far below those limits. The record still tells receivers what you want done with a forgery.
For a domain that sends nothing, set p=reject at once with SPF -all and a null MX. Postelva offers a "no email" template for that case. For a domain with a mailbox, start at none. The transport side of the same protection, encryption between servers, is covered in how to set up MTA-STS and TLS-RPT.
A citable definition: DMARC is the DNS policy that tells receivers what to do with mail whose SPF and DKIM results do not align with the From domain, and where to send reports about it.
DMARC setup questions
Does RFC 9989 require p=reject?
No. The standard defines three policies and leaves the choice to the domain owner. It advises a gradual path and warns against p=reject for domains whose users post to mailing lists.
Does RFC 9989 change my existing DMARC record?
Records still start with v=DMARC1, so a working record keeps working. The ri tag was dropped, pct was removed and t, np and psd were added.
What happens if I publish p=reject too early?
Legitimate mail that fails alignment, such as a forgotten newsletter tool, is refused by receivers. The reports at p=none exist to find those senders first.
Can I use a free mailbox for the reports?
Yes, any mailbox that you read. A separate address or alias keeps the daily report files out of your main inbox.
How many DMARC records can a domain have?
One per name, at _dmarc.yourdomain. Subdomains can have their own record or inherit the parent's policy through sp.
In summary
- DMARC is a TXT record at _dmarc.yourdomain starting with v=DMARC1.
- RFC 9989 (May 2026) is the current specification; it obsoletes RFC 7489 and removes pct.
- Start at p=none with an rua address, read reports for about a month.
- Then p=quarantine for a similar period, then p=reject.
- A message passes when SPF or DKIM passes and aligns with the From domain; relaxed alignment is the default.
- A domain on p=reject must not rely on SPF alone and should not be used with mailing lists.
- Postelva hosts the record in free DNS; a .com costs $12.49/year every year.
Sources (6)
- RFC 9989, Domain-based Message Authentication, Reporting, and Conformance (DMARC) — RFC Editor (read 2026-11-12)
- RFC 7489, DMARC (obsoleted) — RFC Editor (read 2026-11-12)
- SPF, DKIM and DMARC for a custom domain — Mailbox.org (read 2026-11-12)
- Custom domain and anti-spoofing — Proton (read 2026-11-12)
- Email sender guidelines — Google Workspace Admin Help (read 2026-11-12)
- Strengthening email security: new requirements for high-volume senders — Microsoft Tech Community (read 2026-11-12)