How to Implement DMARC: A Step-by-Step Guide

May 27, 2025 • DMARCFlow Team

Email remains a primary vector for phishing and spoofing attacks. Major providers such as Google, Yahoo and Microsoft now require large senders to authenticate their domains with SPF, DKIM and DMARC. Implementing DMARC correctly strengthens your email security, improves deliverability and protects your brand from abuse.

Understanding DMARC and Its Prerequisites

Domain-based Message Authentication, Reporting and Conformance (DMARC) is a policy framework that sits on top of SPF and DKIM. A message passes DMARC when it passes either SPF or DKIM and the domains align with the address in the From header. DMARC fails when a message fails both SPF and DKIM or their alignment checks. Because DMARC relies on SPF and DKIM, you must configure those protocols before publishing a DMARC policy.

Configure SPF Correctly

SPF lists mail servers that are authorized to send mail for your domain. Create a TXT record under the root domain (for example, example.com) starting with v=spf1 followed by mechanisms such as ip4, ip6 and include, and end with -all or ~all. Be mindful of the SPF lookup limit: the evaluation of your SPF policy must not require more than ten DNS lookups. Exceeding this limit can cause a permanent error and lead to failed SPF results. Remove unused services, avoid unnecessary mechanisms like ptr and mx, and consider dynamic SPF management tools to stay within the limit.

Configure DKIM Correctly

DKIM provides a cryptographic signature that proves an email has not been altered and that it originated from your domain. To set up DKIM, generate a public-private key pair (2048-bit keys are recommended for stronger security). Publish the public key in DNS under a selector, such as selector1._domainkey.example.com, and configure your mail servers or email service providers to sign outgoing messages with the private key. Use multiple selectors for key rotation, rotate keys regularly and monitor signatures through DMARC reports.

Step 1 - Audit Your Email Infrastructure

Start by taking inventory of all domains and subdomains that send email on your behalf. Document primary domains, marketing and transactional subdomains, and any third-party platforms like marketing tools, customer relationship management systems or billing applications. Without a complete inventory you risk missing legitimate sources, which can lead to false positives once DMARC is enforced.

Next, confirm SPF and DKIM configuration for every sending service. Ensure that IP addresses and include directives in your SPF record match all legitimate senders. Verify that every service signs outbound mail with DKIM using the correct domain and selector. Correct any misconfigurations before proceeding.

Step 2 - Prepare Mailboxes for DMARC Reports

DMARC generates two types of reports: aggregate reports (RUA) and forensic reports (RUF). Aggregate reports arrive daily and summarise authentication results, while forensic reports arrive immediately after failures and contain copies of failing messages. Set up dedicated mailboxes or groups to receive these reports. Large organisations may receive thousands of reports per day, so do not forward them to personal inboxes. Use a reporting service or automation tool to collect and parse these XML reports.

Step 3 - Create Your DMARC Record

A DMARC record is a DNS TXT record published at _dmarc.example.com. At a minimum it must contain the version and policy tags. Start in monitoring mode to gather data without affecting mail flow. A basic monitoring record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100; adkim=r; aspf=r

Key tags include:

  • p - The policy for handling failing messages (none for monitoring, quarantine to send suspicious messages to spam folders, or reject to block them).
  • rua - The email address or addresses (comma-separated) that will receive aggregate reports. Always prefix addresses with mailto:.
  • ruf - Optional address for forensic reports. Note that some providers do not support forensic reporting.
  • pct - Percentage of failing messages subject to the policy. Use values below 100 when gradually enforcing DMARC.
  • sp - Optional subdomain policy. When omitted, subdomains inherit the main policy.
  • adkim and aspf - Alignment modes. Relaxed alignment (r) accepts subdomains; strict alignment (s) requires exact domain matches.

Choose your policy carefully. Monitoring (p=none) lets you see which sources pass or fail without affecting delivery. Quarantine marks failing messages as spam, while reject blocks them entirely. The DMARC record can include other tags such as fo for forensic report options, rf and ri for report format and interval, but these are optional.

Step 4 - Publish the Record to DNS

Once your record is ready, log in to your DNS provider or domain registrar. Create a new TXT record with the name _dmarc and paste the DMARC record as its value. Some providers automatically append your domain, so verify the final host name. Set a low time-to-live (TTL) during testing to allow quick updates. After publishing, use DNS lookup tools to confirm that the record has propagated correctly.

Step 5 - Monitor and Analyse Reports

Allow a few days for providers to start sending reports. Aggregate reports include the sending IP addresses, pass or fail results for SPF and DKIM, and the action taken according to your policy. Analyse these reports to identify unknown senders, authentication failures and misaligned domains. Prioritise high-volume sources and fix problems by updating SPF includes, adding DKIM signatures or adjusting alignment. Forensic reports, if enabled, provide detailed information about individual failures; handle them with care to avoid exposing sensitive data.

Step 6 - Fix Authentication Issues

Use your analysis to update SPF and DKIM. Add missing IP addresses or update include statements for third-party services. Remove obsolete services and ensure the record stays within the ten-lookup limit. Where possible use ip4 or ip6 mechanisms rather than nested includes. For DKIM, enable signing on services that lack it, ensure selectors are correct and rotate keys regularly. If you forward email, implement Sender Rewriting Scheme (SRS) or use the Authenticated Received Chain (ARC) protocol to maintain authentication through forwarding.

Step 7 - Gradually Enforce Your DMARC Policy

After you have resolved major issues and authentication pass rates are consistently high, move from monitoring to enforcement. First change the policy to quarantine with a small percentage (for example 25 percent). Increase the pct value gradually while monitoring for unintended impacts. When you are confident that all legitimate messages pass, switch to reject and again start with a low percentage before moving to 100 percent. Do not rush this process; give stakeholders time to report any missing emails and be ready to adjust your policy if necessary.

Step 8 - Maintain and Optimise Your DMARC Deployment

Email infrastructure evolves. Make DMARC monitoring part of your regular operations. Review aggregate reports weekly or monthly, set up alerts for sudden increases in failures or new sending sources, and update SPF and DKIM records when you add or remove services. Rotate DKIM keys at least once a year and ensure your DNS provider supports larger keys. Manage subdomain policies explicitly where needed. Once your policy is at reject, consider implementing advanced protocols like MTA-STS and TLS-RPT for transport-layer security and BIMI to display your logo in supported clients.

Why Consider DMARCFlow?

Managing DMARC manually can be challenging. Reports arrive as compressed XML files, SPF records must be kept within lookup limits, and policy progression requires careful timing. A dedicated platform can simplify these tasks. DMARCFlow is designed to help organisations of different sizes implement DMARC effectively without unnecessary complexity.

For small teams or companies consolidating their email authentication, the Standard plan covers up to five domains with 12 months of data retention. It ingests aggregate (and optional forensic) reports and presents them in dashboards with trend analytics. It discovers sending sources automatically, guides you through policy progression from monitoring to quarantine to reject, and sends alerts when new senders or authentication failures appear. PDF and CSV exports and scheduled summaries make it easy to share progress with stakeholders, while safe SPF checks provide read-only guidance to avoid lookup-limit errors. Two-factor authentication, geo-maps and multilingual support enhance security and usability.

Organisations managing many domains may need advanced governance and integrations. The Enterprise plan supports twenty-five domains, retains data for thirty-six months and handles up to three million DMARC messages per month. It adds role-based access control with audit logging, single sign-on (SAML/OIDC) and SCIM provisioning, write-enabled APIs and native connectors for Splunk, QRadar and Elastic. Ticketing integrations with Jira and ServiceNow streamline incident response. Data residency options help meet regional compliance requirements, and the platform processes forensic reports with a built-in viewer. Dynamic SPF management provides flattening, auto-includes and lookup guardrails to keep your record within limits. Additional features like domain blacklist monitoring, adaptive alerts via Slack or Teams, workspace grouping, BIMI readiness checks, and hosted MTA-STS and TLS-RPT services support more complex environments.

For organisations seeking a fully managed outcome, the Enterprise+ plan offers unlimited domains and users, extended data retention and custom message volumes. A dedicated DMARC engineer and customer success manager oversee rollout, including SPF clean-up, DKIM keying and staged policy enforcement. The programme includes weekly operational check-ins, monthly executive reports, threat intelligence with IP reputation enrichment, managed DKIM key rotation and SPF policy automation, and quarterly business reviews. Custom data retention and bring-your-own storage options, on-call escalation and bespoke runbooks ensure that DMARC remains aligned with business needs.

By combining automated reporting, safe SPF management and guided policy progression, DMARCFlow helps organisations achieve DMARC compliance faster and with fewer errors. Choosing the right plan depends on how many domains you manage, how much data you need to retain and how much operational assistance you require.

Common Mistakes to Avoid

  • Skipping SPF or DKIM. DMARC cannot work without SPF and DKIM. Always configure and validate these protocols first.
  • Rushing to enforcement. Spend several weeks collecting and analysing reports before moving to quarantine or reject.
  • Incomplete inventory. Audit all domains, subdomains and sending services to avoid blocking legitimate mail.
  • Ignoring subdomains. Set explicit subdomain policies with the sp tag or create individual records.
  • Exceeding the SPF lookup limit. Keep your SPF record within ten mechanisms that require DNS lookups; use dynamic management to avoid permerror results.
  • Not rotating DKIM keys. Use multiple selectors and rotate keys periodically to maintain cryptographic strength.

Conclusion

DMARC is no longer optional for organisations that send large volumes of email. It protects your brand, improves deliverability and satisfies the requirements of major mailbox providers. Implementing DMARC successfully involves auditing your infrastructure, setting up SPF and DKIM, publishing a DMARC policy, analysing reports, fixing issues and moving carefully to enforcement. Ongoing maintenance ensures that your email authentication remains effective as your business evolves.

Although you can manage these steps manually, platforms like DMARCFlow offer comprehensive tooling, safe SPF management and guided policy progression that shorten deployment time and reduce the risk of misconfiguration. Whether you choose the Standard, Enterprise or Enterprise+ plan, DMARCFlow provides a structured path to email authentication that aligns with operational and compliance needs.