How to set up DMARC without breaking your email
InboxRadar grades your email deliverability free and emails you when it changes. Check your domain.
DMARC is the DNS record that tells Gmail, Outlook and others what to do with email that fails authentication, and it is now effectively required for bulk senders. Done right, it stops people spoofing your domain and lifts your inbox placement. Done carelessly, a strict policy can send your own legitimate mail to spam. The safe path is to roll it out in stages.
Step 1: make sure SPF and DKIM pass first
DMARC only helps if at least one of SPF or DKIM is passing and aligned with your domain. Before you publish DMARC, confirm those are in place. The fastest way is a free InboxRadar check, which grades SPF, DKIM and DMARC together and flags exactly what is missing. If you are still seeing mail filtered, our guide on why email goes to spam covers the upstream fixes.
Step 2: publish a monitor-only record (p=none)
Start by publishing a TXT record at _dmarc.yourdomain with the policy set to none, plus an address to receive reports:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain
At p=none, nothing is blocked. You simply start receiving daily aggregate reports showing who is sending as your domain and whether their mail passes. Leave it here for one to two weeks and read the reports.
Step 3: move to quarantine
Once the reports show your real mail (your provider, your marketing tool, your invoicing system) all passing, tighten the policy to quarantine, which sends failing mail to spam rather than the inbox:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain
Watch the reports for another week to be sure no legitimate sender is failing.
Step 4: move to reject
When you are confident, set the policy to reject, the strongest setting, which tells receivers to drop spoofed mail outright:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain
This is the goal state. Keep the rua address so you keep getting reports and notice if a new sender breaks.
Keep it from silently breaking
Deliverability is not set and forget. A record gets edited, a new tool starts sending, a policy gets weakened. InboxRadar can watch your domain and email you the moment your DMARC policy weakens or your grade drops, so you hear it from us, not from a customer who never got your email.
Common questions
Will turning on DMARC send my own email to spam?
Not if you roll out in stages. Starting at p=none blocks nothing and only collects reports. You only move to quarantine and then reject after the reports confirm your legitimate mail is passing, which is why the staged approach is safe.
What is the rua address for?
rua is where mailbox providers send daily aggregate reports about mail using your domain. It is how you see who is sending as you and whether they pass, which is what makes it safe to tighten the policy.
How fast does a DMARC change take effect?
A DNS change typically propagates within minutes to a couple of hours. Reports arrive once per day, so plan on a few days of monitoring at each stage before tightening.