The fastest way to break your own email is to publish p=reject before you know every system that sends as your domain. The safe way is to climb in stages, using the reports DMARC gives you as a map. This plan works for a freelancer with one domain and for a company with fifty.
If you are new to the record itself, read what DMARC is first. This guide assumes you understand the three policies: none, quarantine and reject.
Before you start: the prerequisites
DMARC passes when SPF or DKIM passes and aligns with the visible From domain. So before touching policy, make sure the basics work for your main sending path:
- SPF is published as exactly one record and is under the lookup limit.
- DKIM signing is on for your main mail source.
- You have an address to receive reports, such as
[email protected].
Stage 1: Monitor with p=none (2 to 4 weeks)
Publish a record that changes nothing for delivery but starts the flow of data:
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Now wait. Aggregate reports arrive daily from the big mailbox providers. You need at least a couple of weeks to catch monthly senders such as invoicing runs, payroll and quarterly newsletters. See how to read DMARC reports for what the XML means.
Your goal in this stage is a list: every source that sends mail using your domain, whether it passes SPF or DKIM, and whether it aligns.
Stage 2: Fix every legitimate source
For each legitimate sender that fails, there are usually only three fixes:
- Add it to SPF if it sends with your domain in the envelope sender.
- Enable DKIM signing with your domain in that service's settings. This is the more robust fix, because DKIM survives forwarding.
- Move it to a subdomain if it cannot sign as your domain. A sender that cannot do either should not be sending as your main domain at all.
Meanwhile, note the sources that are not yours. Those are the spoofing attempts DMARC will eventually block.
Stage 3: Enforce gradually with quarantine
Once legitimate mail passes consistently, tighten the policy but only for part of the traffic:
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]The pct tag applies the policy to that percentage of failing messages. Raise it from 25 to 50 to 100 over a few weeks, reading the reports each time. Failing mail is now sent to spam by cooperating receivers, so an overlooked sender shows up as a complaint rather than a lost message, which is easier to recover from. Note that the DMARC specification is being revised and pct may change in future versions, so check the current standard when you publish.
Stage 4: Move to p=reject
When a month of quarantine shows only unauthorised sources failing, you can publish:
v=DMARC1; p=reject; rua=mailto:[email protected]Now receivers are asked to refuse messages that fail DMARC. Spoofing your exact domain becomes much harder, and your brand is better protected from phishing that borrows your name.
Subdomains and parked domains
- The
sp=tag sets the policy for subdomains. If you do not set it, subdomains inheritp. - Domains you own but never send from should have a strict record from day one: SPF
v=spf1 -allandv=DMARC1; p=reject. Nothing legitimate comes from them, so there is no risk.
Mistakes that cause real outages
- Skipping the monitoring stage. You cannot protect what you have not mapped.
- Forgetting forwarders and mailing lists. They can break SPF and sometimes DKIM. Reports will show it before you enforce.
- Publishing two DMARC records. Receivers may ignore both.
- Sending reports to an address that does not exist. You collect nothing and notice nothing.
- Never moving past p=none. Monitoring is not protection. It does not stop spoofing.
A realistic timeline
| Week | Action |
|---|---|
| 1 | Publish p=none, confirm reports arrive |
| 2 to 4 | Inventory senders, fix failing ones |
| 5 to 6 | p=quarantine; pct=25, then 50 |
| 7 to 8 | p=quarantine; pct=100 |
| 9+ | p=reject if reports are clean |
Where Mailions fits
Mailions includes a suggested DMARC record in each domain's DNS checklist (it starts at p=quarantine) and its live DNS check accepts any valid single record, so if you have not mapped your senders yet, publish p=none as in stage 1 and tighten later. You can collect the reports in a mailbox or alias on the domain and read them in webmail. When your reports are clean, edit the same TXT record to tighten the policy. If you need help planning it for several domains, contact us.