FernTool

How to set up DMARC (step by step)

DMARC is one short DNS record that tells Gmail, Outlook and every other mail service what to do with email that pretends to come from your domain but fails the checks: deliver it, send it to spam, or reject it. Without it, anyone can send email “from” your company address. Before you start, run your domain through the SPF, DKIM & DMARC checker: it tells you what you already have and gives you the exact records to add.

What you need first: SPF and DKIM

DMARC only works on top of the two older checks, so set those up first:

SPF
A TXT record on your domain listing the services allowed to send your email. You can have only one SPF record; add every sender to it.
DKIM
A digital signature your email provider adds to every message, with the public key published in your DNS. Each sending service (Microsoft 365, Google, Mailchimp…) has its own.
DMARC
The rule: an email passes if SPF or DKIM passes and matches the domain in the From address. Otherwise your policy applies.

Step 1: list everything that sends email as you

This is the step people skip, and it’s why DMARC sometimes blocks real email. Write down every system that sends email with your domain in the From address: your mailbox provider, newsletter tool (Mailchimp, Brevo), accounting or invoicing software (Xero, Sage, QuickBooks), your website’s contact form, your CRM, booking or helpdesk system. Each one needs to be in SPF or have its own DKIM set up (their help pages explain how).

Step 2: set up SPF and DKIM for your provider

Microsoft 365

  1. SPF: one TXT record on your domain (name @): v=spf1 include:spf.protection.outlook.com -all. Add other senders’ includes before -all.
  2. DKIM: open the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, pick your domain and copy the two CNAME records it shows (selector1._domainkey and selector2._domainkey). Add them at your DNS host, wait for them to spread, then switch Sign messages for this domain with DKIM signatures on.

Google Workspace

  1. SPF: TXT on @: v=spf1 include:_spf.google.com ~all.
  2. DKIM: in the Google Admin console go to Apps → Google Workspace → Gmail → Authenticate email, choose your domain, click Generate new record (2048-bit), add the TXT record it shows at google._domainkey, wait an hour, then click Start authentication.

Other hosts (cPanel, Zoho, Afrihost, Xneelo, etc.)

Look for “Email Deliverability”, “Email Authentication” or “DKIM” in your hosting panel. Most hosts create SPF and DKIM with one click. Then check both show up in the checker.

Step 3: add the DMARC record (monitor mode)

At your DNS host, add a TXT record:

Name / host
_dmarc (some panels want the full _dmarc.yourdomain.com)
Value
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none means “don’t block anything yet, just send me reports”. The rua address receives daily summary reports (XML files) from Gmail, Outlook, Yahoo and others showing who sends email as you and whether it passes. Create that mailbox or use an existing one. Confirm the record is live everywhere with the DNS propagation checker (put in your own domain).

Step 4: read the reports for 2 to 4 weeks

The raw reports are hard to read, so most people paste them into a free DMARC report viewer or use their email security tool. What you’re looking for: real services of yours that fail. Fix each one (add it to SPF, or turn on its DKIM) before moving on. Anything failing that you don’t recognise is likely someone faking your domain, which is exactly what DMARC will stop.

Step 5: turn on protection

  1. Change the policy to p=quarantine: failing email goes to spam. You can ease in with pct=25 (applies to a quarter of failing mail), then 50, then 100.
  2. After another couple of weeks with no real email failing, change to p=reject: fake email is refused outright. That’s full protection, and the checker will show “Your email is protected”.

A finished record looks like v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com.

Common mistakes

Why it matters now

Since 2024 Gmail and Yahoo require a DMARC record from anyone sending large volumes to their users, and Microsoft followed for Outlook.com in 2025. Even small businesses benefit: DMARC stops scammers sending fake invoices “from” you to your customers, and properly authenticated email is less likely to land in spam (see why emails go to spam).

Frequently asked questions

Is DMARC free?

Yes. DMARC, SPF and DKIM are just DNS records you add at your domain or DNS host. Paid services only help you read the reports.

How long does DMARC take to work?

The record usually spreads within minutes to a few hours. Mail services then apply it immediately; report emails start arriving within a day or two.

Will DMARC stop my emails going to spam?

It helps, because big mail services trust authenticated domains more, but content, sending reputation and complaints matter too. DMARC’s main job is to stop other people faking your domain.

What does p=none mean?

Monitor only: mail services deliver failing email as normal but send you reports. It doesn’t protect you yet. Move to quarantine and then reject once your real email passes.

Do I need DMARC if I only use Gmail or Outlook.com?

No. DMARC is for your own domain (you@yourcompany.com). Free addresses like @gmail.com are protected by Google and Microsoft already.

More guides