Setup guide

How to Set Up DMARC — Step-by-Step DNS and Policy

How to set up DMARC on your domain: publish p=none, collect aggregate reports, fix alignment, then deploy enforcement safely. Clear DNS examples for South African teams.

This guide shows how to set up DMARC on a domain you control: publish a safe monitoring record, learn who sends as you, fix legitimate failures, then move toward enforcement without breaking invoices, support mail, or marketing. It is written for IT admins, MSPs, and business owners who manage DNS and want a clear deploy path — not a research paper.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) does not replace SPF or DKIM. It tells receivers what to do when those checks fail for the visible From domain, and it asks them to send you aggregate reports so you can see the real source inventory.

1. Confirm SPF and DKIM cover your senders

Before you deploy DMARC, every system that sends mail as your domain should have working SPF authorisation and DKIM signing. If those are incomplete, start with the SPF and DKIM guides, or run a free domain check for a public baseline.

Primary mailbox platform (Microsoft 365, Google Workspace, hosted Exchange)
Marketing and newsletter tools
Helpdesk, CRM, billing, HR, and security alerts
Transactional SaaS (password resets, invoices, shipping)

Skipping this step is the usual reason teams publish p=none, panic at the report volume, and never progress to enforcement.

2. Publish a monitoring DMARC record (p=none)

Create a DNS TXT record on the host _dmarc for your domain. Replace the domain and report address with yours. Start in monitoring mode — never jump straight to p=reject without alignment data.

Host: _dmarc.yourdomain.co.za
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.za; fo=1

v=DMARC1 — required version tag; the record must start with this.
p=none — receivers authenticate and report, but typically still deliver failures. Use this while you learn who sends as you.
rua= — mailbox (or product collector) for aggregate XML reports. Prefer a dedicated address or a monitor you will actually open.
fo=1 — forensic options when supported; many providers only send aggregate reports in practice.

Optional tags once you understand them: sp= for subdomain policy, pct= for percentage rollout, adkim / aspf for alignment mode (relaxed is the usual start). Keep the first publish boring.

If you use DMARC Shield, the portal gives you the exact rua address for your account so reports land in the product instead of an overflowing inbox.

3. Collect aggregate reports from real traffic

Leave p=none long enough to see normal senders across a full business cycle: weekday office mail, weekend marketing, payroll, and monthly billing. A few days of real mail beats a single lab send.

Aggregate reports (RUA) arrive as compressed XML from major mailbox providers. They list source IPs, volumes, SPF/DKIM results, and whether the message aligned with your organisational domain. For a practical walkthrough of the fields, see how to read DMARC aggregate reports.

4. Fix alignment gaps one sender at a time

In reports (or your monitor), look for volume that fails SPF and DKIM alignment. Fix high-volume legitimate sources first. Common causes:

New SaaS not added to SPF and not DKIM-signing your domain
SPF permerror (too many DNS lookups — see the SPF guide)
Forwarding that breaks SPF but should still pass via DKIM if signing is correct
Marketing platforms using a subdomain you never authenticated
Third parties sending “from” your brand with only their own domain in the signature

For each intentional sender: enable their domain authentication wizard, publish the DNS they require, and confirm pass + alignment in the next report cycle. Do not raise policy while unknown high-volume sources still fail.

5. Raise policy carefully toward reject

Typical path after the inventory is clean:

p=none until legitimate sources are identified and fixed
p=quarantine (optionally with pct=25 then pct=50 then full) when residual failures are mostly abuse or unknown
p=reject when you accept that unauthenticated mail using your domain should be refused

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.co.za; fo=1

Only move to reject when primary platforms pass consistently and someone is watching reports. Full detail: the safe path from p=none to p=reject.

Managed and Business plans are built around this progression with alerts when DNS or report posture slips. For a once-off cleanup project, see Fix Assist. Ongoing visibility starts on pricing (Monitor and up).

6. Verify the live record and ongoing posture

Confirm the TXT on _dmarc with a DMARC check
Send a test from each major platform and confirm pass + alignment in reports
After you raise policy, watch for a drop in unexpected sources and for new SaaS that need onboarding
Keep a rollback: who can edit DNS and how fast if a critical sender was missed

Common mistakes and troubleshooting

Jumping to p=reject on day one — blocks spoofing and any forgotten legitimate sender. Always monitor first.
No rua (or a mailbox nobody reads) — you get zero operational value; spoofers stay invisible to you.
Wrong host name — the record belongs on _dmarc.domain, not the apex TXT next to SPF.
Multiple DMARC TXT records — publish one coherent policy; conflicting records confuse receivers.
Treating SPF pass alone as enough — DMARC needs alignment with the From domain; SPF pass on a different domain does not satisfy DMARC.
Ignoring subdomains — marketing hosts like mail.yourdomain.co.za may need their own authentication or an explicit sp= policy.

FAQ

How long should I leave DMARC on p=none?

Until you have report coverage for a normal business cycle and known intentional senders pass consistently. Small domains often need one to two weeks; complex estates may need longer. Do not treat monitoring as a permanent destination if you care about spoofing protection.

Do I need SPF and DKIM both before setting up DMARC?

You can publish a monitoring record immediately, but enforcement is unsafe until senders are authorised (SPF) and signed (DKIM). DMARC evaluates those results; it does not fix missing platform configuration by itself.

What is the difference between quarantine and reject?

Quarantine asks receivers to prefer spam/junk for failing messages. Reject asks them to prefer not accepting failing messages at all. Exact behaviour varies by mailbox provider; both raise the cost of spoofing and of unauthenticated legitimate mail.

Where should rua point?

To an address or collector that someone reviews on a schedule. A personal inbox fills with compressed XML and gets ignored. Product collectors (including DMARC Shield) parse reports into sources and volumes you can act on.

Will DMARC stop lookalike domains?

No. DMARC protects your exact domain (and subdomains per policy). Typosquat and lookalike domains need separate monitoring and process — see lookalike domains vs spoofing.