How to add a DMARC record without breaking your email

November 8, 2026

DMARC tells receiving servers what to do with mail that claims to come from your domain but fails authentication. Set up carelessly, it can block your own email. Set up in the right order, the first step changes nothing about delivery and just starts sending you reports.

Step 1: Make sure SPF or DKIM already works

DMARC builds on SPF and DKIM. Google's setup guide says SPF and/or DKIM should be authenticating your mail for at least 48 hours before you turn DMARC on. List everything that sends as your domain first: your mailbox provider, your newsletter tool, your CRM, your invoicing system. Each one needs to be covered.

Step 2: Publish a monitor-only record

Add a TXT record in your DNS:

Replace the address with a mailbox you actually read. p=none means mail is delivered as normal and you receive reports. Google recommends starting here.

Some DNS panels add your domain to the host automatically, and others want the full _dmarc.example.com. If your panel shows existing records with short names, use the short name.

Step 3: Check that it's live

From a terminal:

dig +short TXT _dmarc.example.com

You should see your record once, and only once. A domain with two DMARC records has an invalid setup, which is one of the most common mistakes. Edit the existing record instead of adding another.

Step 4: Read the reports

Reports arrive as XML attachments, usually daily, from the providers that received your mail. A free report reader makes them easier to scan. You're looking for legitimate senders that fail. The usual cause is a tool you forgot about, or one that signs with its own domain instead of yours.

Google doesn't set a fixed monitoring period. Stay at p=none until the reports show your real mail passing.

Step 5: Tighten slowly

Once your legitimate mail passes, change p=none to p=quarantine, then later to p=reject. Google suggests using the pct tag to apply the policy to a small share of failing mail at first, and raising it until you reach 100 percent.

Two settings to be careful with

• Strict alignment. Google's example record includes adkim=s; aspf=s. Strict alignment requires an exact domain match, which can fail for mail sent from subdomains or some third-party tools. If you leave these tags out, alignment is relaxed.
• Jumping straight to reject. Any sender you missed will start failing with no warning. Monitor first.

Do you need it?

If you send more than 5,000 messages a day to Gmail accounts, Google requires SPF, DKIM and DMARC, and a policy of none is enough to meet that rule. Smaller senders aren't required to have DMARC, but it costs nothing and shows you who is sending as your domain.