Email spoofing and phishing are serious threats to businesses. Hackers can send fake emails using your domain, tricking recipients into sharing sensitive information or clicking malicious links. If your domain isn't protected, you're leaving your business open to attacks.

That’s where DMARC (Domain-based Message Authentication, Reporting & Conformance) comes in. But how do you setup DMARC?

Setting up a DMARC record is a straightforward way to prevent spoofing, protect your domain, and improve email deliverability. In this guide, we’ll walk you through how to setup DMARC in a few simple steps.

Before we begin, it’s important to understand the risk. Without DMARC, anyone can send emails that appear to come from your domain. This leads to phishing scams, reputational damage, and potential financial or legal consequences.

DMARC gives you visibility and control. It authenticates emails sent from your domain and tells receiving servers what to do with messages that fail verification. The result? Stronger email security, improved trust, and better inbox placement.

How To Setup DMARC Record

Let’s get right into how you can set up DMARC for your domain.

Step 1: Set Up SPF and DKIM (Pre-requisites)

Before you learn how to setup DMARC, you need two things: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). These are the foundational protocols that DMARC uses to verify emails.

• SPF allows you to specify which mail servers are allowed to send emails on behalf of your domain.
• DKIM adds a digital signature to your emails, ensuring they haven’t been altered in transit.

Without SPF and DKIM in place, DMARC won’t work properly. So, set those up first.

SPF and DKIM Setup – Quick Links and Best Practices

Before you move to Step 2, it helps to validate whether SPF and DKIM are correctly set up.

Here are some quick checks and tips to help you configure them accurately:

SPF Setup Best Practices

• Use online validators like Smartlead's SPF Checker and SPF Record generator to validate your SPF records.
• Avoid too many "include:" statements in your SPF record. SPF has a 10 DNS lookup limit. If you exceed this, your SPF check can fail even if the record is correct.
• List only verified sending sources – include all email service providers that send on your behalf (like Gmail, Outlook, Mailgun, etc.).
• Syntax matters – end your SPF record with ~all or -all. Use ~all for softfail during initial testing.

Example:

v=spf1 include:_spf.google.com include:mailgun.org ~all

DKIM Setup Best Practices

• Use 2048-bit keys instead of 1024-bit for stronger encryption. Most DNS providers support it.
• Check DKIM alignment – your DKIM domain should match the “From” domain or subdomain.
• Use recognizable selectors, such as default or mail, to manage keys more easily.

Now, let's move on to the second step in learning how to setup DMARC.

Step 2: Log in to Your DNS Hosting Provider

Now that SPF and DKIM are set up, it’s time to log in to your DNS hosting provider. This is where you’ll add your DMARC record. If you’re not sure who your DNS provider is, think of companies like GoDaddy, Cloudflare, or Namecheap.

Once logged in, find the option to manage your domain’s DNS records.

Step 3: Add a DMARC Record

Now, you’ll create a DMARC record in your DNS settings. This is a TXT record that tells receiving email servers how to handle emails that fail the DMARC check.

The DMARC record format looks something like this:

_dmarc.yourdomain.com  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarcreports@yourdomain.com; ruf=mailto:dmarcforensics@yourdomain.com; pct=100"

• v=DMARC1: This specifies the DMARC protocol version.
• p=none: This is your policy. You can choose between "none," "quarantine," or "reject."
• rua=: This is where you want to receive aggregate reports.
• ruf=: This is where you want to receive forensic reports.
• pct=100: This specifies the percentage of emails subjected to your DMARC policy.

We’ll explain more about these in the next section.

Step 4: Set Your DMARC Policy (p=none, quarantine, reject)

Next, you need to decide how strict you want to be with your DMARC policy.

• p=none: This policy monitors but doesn’t enforce anything. It’s a good starting point.
• p=quarantine: Emails that fail the DMARC check are sent to spam or a quarantine folder.
• p=reject: This is the strictest policy. Emails that fail the DMARC check are completely rejected.

Start with p=none to gather data and see how things are working before tightening up your policy.

Step 5: Publish the DMARC Record

Once your DMARC record is set, go ahead and publish it. Your DNS provider should have a button or option to “Save” or “Publish” the changes.

At this point, your DMARC policy is live! Your domain is now actively protected, and you’ll begin receiving reports on how your email traffic is being handled.

Popular DMARC Tags and Their Meanings

As you saw earlier, the DMARC record has several components. Here’s a quick breakdown of the most important ones:

v=DMARC1

This simply specifies that you’re using DMARC version 1. This is standard and doesn’t change.

p=Policy

This is the action you want to take if an email fails DMARC. The options are:

• none: No action, just collect reports.
• quarantine: Emails that fail go to the spam folder.
• reject: Block emails that don’t pass DMARC.

rua= and ruf=

These specify where reports should be sent:

• rua=: Aggregate reports (high-level data on your email traffic).
• ruf=: Forensic reports (detailed data about individual email failures).

sp=Policy for Subdomains

This is important if you have subdomains. You can specify a separate DMARC policy for emails coming from your subdomains. If you don’t set this, your subdomains will inherit the main domain’s DMARC policy.

pct=Percentage

This tag lets you apply the DMARC policy to only a portion of your email traffic. For example, pct=50 will apply your policy to 50% of emails. Start small and scale up to pct=100 as you gain confidence.

DMARC Record Example

Here’s what a complete DMARC record might look like:

_dmarc.yourdomain.com  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarcreports@yourdomain.com; ruf=mailto:dmarcforensics@yourdomain.com; pct=100; sp=reject"

This DMARC record tells the receiving servers to:

• Quarantine any email that fails the DMARC check.
• Send aggregate and forensic reports to specific email addresses.
• Apply this policy to 100% of the emails and use a reject policy for subdomains.

DMARC Testing: How To Verify Your DMARC Setup

Now when you have learned how to setup DMARC record, the next step is to ensure that it’s working as expected. 

Testing and verifying your DMARC setup will help you avoid misconfigurations that could either block legitimate emails or allow spoofed emails to slip through. 

Here’s how you can verify your DMARC configuration and fine-tune it for optimal performance.

Using Online DMARC Check Tools

You don’t have to manually sift through DNS settings or second-guess whether your DMARC setup is correct. There are several free and paid online DMARC check tools that do the heavy lifting for you. These tools will analyze your DNS records and ensure that your DMARC configuration is functioning as intended.

Smartlead offers a free DMARC checking tool that allows you to verify your setup with ease. This tool not only checks for the presence of DMARC, SPF, and DKIM records but also provides detailed feedback if there are any issues or misconfigurations. You’ll receive actionable insights to fine-tune your DMARC settings.

Receiving and Reviewing DMARC Reports

The power of DMARC lies not just in blocking phishing attempts but also in its ability to provide comprehensive reports. 

DMARC generates two types of reports: aggregate (rua) and forensic (ruf). These reports give you a window into how email servers around the world are handling your domain’s emails, making it easier to identify any issues or malicious attempts.

Here’s what you need to know about each report:

• Aggregate Reports (rua): These reports give you a high-level summary of how your domain’s emails are being authenticated. They show how many emails passed DMARC, SPF, and DKIM checks, and how many failed. While they don’t provide specific details about individual email failures, they help you spot trends and anomalies in your email traffic. You’ll also be able to see if certain email services or regions are rejecting your emails or marking them as spam.
• Forensic Reports (ruf): These reports are more granular and focus on specific emails that failed the DMARC check. Forensic reports provide detailed information about each failure, including the email's sender, headers, and the exact reasons it didn’t pass authentication. This makes it easier to investigate why certain emails failed and take corrective action.

To review these reports, log in to the email address specified in the rua and ruf tags of your DMARC record. Make it a habit to check these reports regularly, especially in the early days of your DMARC setup. By doing so, you can:

• Spot issues quickly: DMARC reports will show you if legitimate emails are being quarantined or rejected. If that happens, you can modify your SPF and DKIM records, or adjust your DMARC policy to resolve the problem.
• Fine-tune your policy: If you start with a “p=none” policy (which is advisable), DMARC reports will help you understand how your domain’s emails are performing. Over time, you can move to a stricter policy like “quarantine” or “reject” as you become more confident in your setup.
• Identify potential threats: These reports will also reveal if someone is attempting to spoof your domain. If a large number of emails are failing DMARC from unauthorized servers, you can investigate further to ensure your domain isn’t being used in phishing attacks.

Many DMARC check tools, including Smartlead’s, offer the option to automate report reviews, making it even easier to stay on top of your domain’s email security.

How DMARC Affects Deliverability

DMARC is a vital part of email authentication, but its influence extends beyond just protecting your domain from spoofing and phishing attacks. 

It plays a crucial role in solving your email deliverability issues, ensuring that your legitimate emails actually reach your recipients' inboxes, while also protecting your organization’s reputation.

Email Authentication and Deliverability

When your DMARC is set up correctly, it works hand in hand with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to authenticate the emails coming from your domain. 

By doing this, DMARC helps verify that you are the true sender of the email and not someone trying to impersonate you.

Here’s how this improves deliverability:

• Fewer Emails Marked as Spam: Email providers like Gmail, Outlook, and Yahoo are more likely to trust emails that are properly authenticated. This means your emails are less likely to be flagged as spam or junk mail, increasing the chances of them landing in your recipients’ primary inbox.
• Improved Sender Reputation: When your domain consistently passes DMARC, your email sender reputation improves. This is important because email providers use sender reputation as a key factor in deciding whether or not to deliver your emails to the intended recipients. A high sender reputation means fewer emails being rejected or bounced, which in turn boosts your overall deliverability.
• Increased Customer Trust: DMARC tells email recipients that your emails are legitimate. If recipients know they can trust the emails coming from your domain, they are more likely to engage with them. Over time, this builds trust with your audience, which can translate into better open rates, click-through rates, and conversions.

In short, a well-configured DMARC record not only protects your domain but also helps improve the overall deliverability of your emails, ensuring they reach the people who matter most to your business.

How DMARC Prevents Phishing and Spoofing Attacks

One of DMARC's primary purposes is to protect your domain from being used in phishing and spoofing attacks. 

Phishing, where cybercriminals try to trick recipients into giving up sensitive information, often involves sending fake emails that appear to be from a trusted source. Spoofing takes this a step further by falsifying the “from” address to make it look like the email is coming from a legitimate domain — possibly your domain.

Here’s how DMARC prevents this:

• Domain Owners Have Control: With DMARC, you, as the domain owner, get to dictate how emails from your domain are handled if they fail SPF or DKIM checks. Whether you want these emails to be rejected, quarantined, or simply monitored, DMARC gives you the tools to make that decision.
• Prevents Fraudulent Emails from Reaching Recipients: When you set your DMARC policy to "reject," any emails that don’t pass SPF or DKIM authentication are automatically blocked. This means fraudulent emails trying to use your domain in phishing attacks never even reach your recipients’ inboxes. This not only protects your brand but also protects your customers from potentially falling victim to these scams.
• Strengthens Email Security: Implementing DMARC makes it significantly harder for attackers to spoof your domain. Without DMARC, hackers can easily forge your domain in the “from” field of emails, fooling unsuspecting recipients into believing the email is legitimate. By enforcing DMARC, you create a security barrier that adds an extra layer of protection for both your domain and your recipients.

By stopping phishing and spoofing attempts at the source, DMARC helps you maintain control over how your domain is used, safeguarding your brand's reputation and keeping your recipients safe.

Impact of Incorrect DMARC Setup

While DMARC is incredibly effective when configured correctly, an incorrect DMARC setup can do more harm than good. Misconfiguring your DMARC record can lead to several issues that can hurt your email performance and deliverability.

• Blocking Legitimate Emails: If your DMARC policy is too strict (for example, setting it to "reject" too early without thoroughly testing), you could end up blocking legitimate emails from being delivered. This can cause frustration for both you and your recipients, as important emails may be flagged as spam or rejected outright.
• Unintended Quarantining of Emails: A misconfigured DMARC record can also result in legitimate emails being quarantined. This means your emails may be redirected to spam folders instead of reaching your recipients' inboxes. This can hurt your communication efforts and decrease the effectiveness of your email campaigns.
• Failing to Prevent Spoofing: On the flip side, if your DMARC setup is too lax or incomplete (e.g., if you set your policy to "none" indefinitely), you might not be preventing spoofing or phishing attempts. Without DMARC enforcement, unauthorized users could continue to send fraudulent emails using your domain, damaging your brand’s reputation and putting your recipients at risk.
• Deliverability Issues Due to Improper Configuration: Even minor mistakes in your DMARC, SPF, or DKIM records can lead to emails failing authentication checks. This can cause deliverability issues, as email providers might reject or flag your emails as suspicious.

To avoid these pitfalls, it’s crucial to review and test your DMARC configuration regularly. Start with a "none" policy to monitor how your domain is performing, and gradually move toward stricter policies like "quarantine" or "reject" once you’re confident everything is set up correctly.

Common DMARC Setup Mistakes & Troubleshooting Tips

Even a small misconfiguration in your DMARC, SPF, or DKIM record can break authentication or block valid emails. Here are frequent mistakes and how to fix them:

❌ Common Mistakes

• Publishing a DMARC record without configuring SPF and DKIM first.
• Setting p=reject without testing your setup via p=none.
• Using invalid email addresses in rua or ruf fields.
• Having multiple DMARC records – only one is allowed per domain.
• Exceeding SPF DNS lookup limit (more than 10).

🛠 Troubleshooting Tips

• Use MXToolbox or Smartlead's tool to validate records in real time.
• Keep DMARC policy at p=none during the initial 1–2 weeks.
• Check that your email service providers are properly included in the SPF record.
• Review reports frequently and gradually adjust your DMARC policy to quarantine and then reject.

Conclusion: Importance of Setting Up DMARC for Domain Protection

Setting up DMARC is one of the best things you can do to protect your domain from email spoofing and phishing attacks. It gives you control over who can send emails on your behalf, improves email deliverability, and enhances customer trust.

We hope you liked our guide on how to setup DMARC record.

If you haven’t done so already, now’s the time to get started.

Learning how to set up DMARC isn’t complicated, and once you do it, you’ll have a safer, more secure email system in place. Don’t forget to review your DMARC reports regularly to ensure everything is working smoothly and to adjust your policy as needed.

If you're still unsure of email authentication best practices and don't want to deal with the technical headaches of setting up MX records, you can buy pre-configured domains and mailboxes from our SmartSender tool. You get deliverability optimized mailboxes from Google and Microsoft without the technical hassles.