DMARC guide: block spoofing of your domain

DMARC tells recipients what to do with an email that claims to come from your domain without proving it, and sends you reports. Here is how to publish it and tighten it step by step, all the way to rejection.

What DMARC is for

SPF and DKIM check technical domains that the recipient never sees. A fraudster can therefore pass SPF with their own domain while displaying management@exemple.nc as the sender. DMARC (RFC 7489) closes this gap: it requires the displayed address, the one in the "From" field, to match a domain validated by SPF or by DKIM.

DMARC provides three things:

a policy: do nothing (none), quarantine (quarantine) or reject (reject) the emails that fail;
reports: every day, the large email providers tell you which servers sent emails in your name, and with what result;
protection for subdomains, which inherit the policy of the main domain.

Since 2024, Gmail and Yahoo have required a DMARC record from domains that send them large volumes, and Outlook.com followed in 2025.

Alignment

An email passes DMARC if at least one of these two conditions is met:

SPF passes, and the domain of the technical sending address (Return-Path) is the one in the "From" field;
DKIM passes, and the signing domain (d=) is the one in the "From" field.

With relaxed alignment (r, the default), a subdomain is enough: news.exemple.nc is aligned with exemple.nc. With strict alignment (s), the domains must be identical.

A DMARC record explained

The record is a TXT record published on the domain's _dmarc name:

_dmarc.exemple.nc.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@exemple.nc; adkim=r; aspf=r"

Tag	Meaning
`v=DMARC1`	Mandatory start, always first.
`p`	The domain's policy: `none`, `quarantine` or `reject`. Mandatory.
`sp`	The policy for subdomains. If absent, they follow `p`.
`pct`	The share of failing emails subject to the policy, from 0 to 100 (100 by default).
`rua`	The address for daily aggregate reports, in `mailto:` format.
`ruf`	The address for detailed failure reports. Few email providers send them.
`adkim`, `aspf`	DKIM and SPF alignment: `r` (relaxed, the default) or `s` (strict).
`fo`	Conditions for sending failure reports.

Moving up step by step: none, quarantine, reject

Going straight to p=reject risks blocking legitimate emails sent by a service you had forgotten about. The safe method takes three steps.

Observe, with p=none. Publish v=DMARC1; p=none; rua=mailto:dmarc@exemple.nc. Nothing is blocked, but reports start arriving. For two to four weeks, identify every service that sends with your domain and fix its SPF or DKIM until it passes DMARC. In Domain Check, this step scores 30: it reports spoofing without stopping it.
Quarantine, with p=quarantine. Emails that fail land in the junk folder. You can start with pct=25, then increase it, but do not stop there: as long as pct is below 100, some spoofed emails get through. Score: 80, or 60 with pct below 100.
Reject, with p=reject. Emails that spoof your domain are refused before they reach the recipient's mailbox. This is the goal: 100 in Domain Check. Keep the reports to spot any new, badly configured service.

A domain that sends no email can go straight to v=DMARC1; p=reject;, with a v=spf1 -all SPF record.

rua reports

Aggregate reports are XML files, often compressed, sent once a day by each large email provider. They list the IP addresses that sent emails in your name, their volume and the SPF, DKIM and DMARC results. They do not contain the text of the emails.

Use a dedicated mailbox, for example dmarc@exemple.nc: the volume can be significant.
To read them, a DMARC analysis service turns these files into readable tables.
If reports go to another domain (that of an IT provider or an analysis service), that domain must publish an authorisation: a v=DMARC1 TXT record on exemple.nc._report._dmarc.<provider-domain>. Without it, most email providers do not send the reports. Analysis services usually take care of this.

Publishing DMARC for Microsoft 365

First check that SPF (include:spf.protection.outlook.com) and DKIM (selector1, selector2) are in place and that DKIM signing is enabled: see the SPF and DKIM guides.
At your domain's DNS host, create a TXT record named _dmarc:
```
v=DMARC1; p=none; rua=mailto:dmarc@exemple.nc
```
If your DNS is managed by Microsoft 365, the record is added in the Microsoft 365 admin center, under Settings, then Domains.
Follow the step-by-step progression above up to p=reject.

Microsoft documentation: set up DMARC for Microsoft 365 (opens in a new tab).

Publishing DMARC for Google Workspace

First turn on SPF (include:_spf.google.com) and DKIM (selector google), then wait 48 hours for DKIM authentication to take effect.
At your domain's DNS host, create a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc@exemple.nc. DMARC is not configured in the Google Admin console: it is published in DNS only.
Follow the step-by-step progression up to p=reject.

Google documentation: set up DMARC (opens in a new tab).

Publishing DMARC with another provider

DMARC does not depend on your email provider: it is a single TXT record, named _dmarc, that you publish at your DNS host. Before going beyond p=none, check that every service sending with your domain passes SPF or DKIM with an aligned domain. The safest approach is to set up DKIM for each of them, with your own domain.

Subdomains. A subdomain without DMARC applies the main domain's sp policy, or failing that its p policy. Only set sp=none if a subdomain genuinely needs it: otherwise, your subdomains remain open to spoofing. Domain Check deducts 10 points in this case.

Common mistakes

Wrong name. The record is published on the domain itself instead of _dmarc.exemple.nc.
Two DMARC records. Recipients then ignore the policy.
Staying at p=none. It is an observation step, not protection: spoofing is reported, not blocked.
Moving to p=reject too quickly. A forgotten service, such as invoicing software, has its emails rejected.
Forgetting pct. A pct=10 left in place after testing protects only one email in ten.
rua without mailto:, or pointing to an external domain without authorisation: no reports arrive.
sp=none while the main domain is protected: subdomains can be used to impersonate you.

Check your DMARC. Domain Check reads your policy, checks the reports and the authorisation of external domains, and offers you the record for the next step. Test my domain