---
title: How to Set Up DMARC (step by step)
description: DMARC is what actually stops scammers spoofing your domain — but rushing it can block your own email. Here's the safe, staged way to roll it out from monitoring to full enforcement.
canonical: https://watchfor.io/blog/dmarc-setup-guide
---

# How to Set Up DMARC (step by step)

2025-11-30 · WatchFor Team · Email · email, security, dns

DMARC is what actually stops scammers spoofing your domain — but rushing it can block your own email. Here's the safe, staged way to roll it out from monitoring to full enforcement.

[DMARC](/blog/spf-dkim-dmarc-explained) is the record that turns email authentication from "detect spoofing" into "**block** spoofing." It's also the one people are scared to enable, because done carelessly it can send your *own* legitimate mail to the void. The secret is a staged rollout. Here's the safe path.

## What DMARC needs first

DMARC builds on SPF and DKIM — it tells receivers what to do when those checks fail. So before DMARC does anything useful:

| Prerequisite | Status to confirm |
| --- | --- |
| **SPF** record published | Lists all your sending sources |
| **DKIM** signing enabled | Your mail is signed |

If SPF and DKIM aren't solid, fix those first ([full guide](/blog/spf-dkim-dmarc-explained)). DMARC without them does nothing helpful.

## The three policies

DMARC's `p=` tag controls what happens to mail that fails authentication:

| Policy | Effect | Use when |
| --- | --- | --- |
| `p=none` | Monitor only — nothing blocked | Starting out |
| `p=quarantine` | Failing mail → spam folder | Confident, ramping up |
| `p=reject` | Failing mail → blocked entirely | Fully validated |

The whole game is moving safely from `none` to `reject`.

## The staged rollout

### Step 1: Publish `p=none` with reporting

Add a DMARC [TXT record](/blog/dns-record-types-explained) at `p=none` and turn on **aggregate reports** (the `rua` tag). This blocks *nothing* — it just starts sending you reports on who's sending mail as your domain.

> **`p=none` is your reconnaissance phase.** It does no enforcement, so it's completely safe — but the reports reveal every source sending as you, including legitimate services you forgot about *and* spoofers. Don't skip it.

### Step 2: Read the reports

For a few weeks, study the reports. The goal: make sure **all your legitimate mail passes** SPF or DKIM. You'll often discover a forgotten sender (a CRM, a support tool, a payment provider) that needs adding to SPF/DKIM. Fix those gaps now — while nothing is being blocked.

### Step 3: Move to `p=quarantine`

Once you're confident your real mail passes, tighten to `p=quarantine`. Now failing mail goes to spam rather than the inbox. Consider starting with a **percentage** (`pct=`) to ramp gradually. Watch for any legitimate mail getting caught.

### Step 4: Move to `p=reject`

When quarantine has run cleanly, go to `p=reject`. Now spoofed mail is **blocked outright** — full protection against exact-domain [spoofing](/blog/domain-spoofing). This is the destination.

## A handy timeline

| Phase | Policy | Duration (typical) |
| --- | --- | --- |
| Monitor | `p=none` | 2–4 weeks |
| Soft enforce | `p=quarantine` (ramp pct) | 2–4 weeks |
| Full enforce | `p=reject` | Ongoing |

## The cardinal rule

> **Never jump straight to `p=reject`.** If a legitimate sender isn't covered by SPF/DKIM, reject will silently block your real mail — receipts, resets, the lot. Always go none → quarantine → reject, reading the reports at each step.

## A monitoring connection

Once enforced, DMARC must keep working. A DNS change that drops your SPF/DKIM, or a key rotation, can suddenly make your *own* mail fail under `p=reject`. [Monitoring your email policy records](/docs/monitors/email) catches that drift before it bins your email.

## The bottom line

| Step | In one line |
| --- | --- |
| **Prereq** | Solid SPF + DKIM first. |
| **1. `p=none`** | Monitor safely; read the reports. |
| **2. `p=quarantine`** | Ramp enforcement; failing mail to spam. |
| **3. `p=reject`** | Full protection; spoofing blocked. |

DMARC is the difference between detecting spoofing and stopping it — but it rewards patience. Roll out none → quarantine → reject, fix every legitimate sender along the way, and you get airtight protection without ever losing your own email.

Related: [SPF, DKIM & DMARC](/blog/spf-dkim-dmarc-explained), [domain spoofing](/blog/domain-spoofing); check your DMARC with the free [DMARC checker](/dmarc-record-checker).

---

Canonical page: https://watchfor.io/blog/dmarc-setup-guide · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt