---
title: How to Set Up DMARC (step by step)
description: DMARC is what actually stops scammers spoofing your domain — but rushing it can block your own email. Here's the safe, staged way to roll it out from monitoring to full enforcement.
canonical: https://watchfor.io/blog/dmarc-setup-guide
---

[All posts](/blog) [Email](/blog/category/email) Nov 30, 2025 · 3 min read · WatchFor Team

# How to Set Up DMARC (step by step)

DMARC is what actually stops scammers spoofing your domain — but rushing it can block your own email. Here's the safe, staged way to roll it out from monitoring to full enforcement.

[DMARC](/blog/spf-dkim-dmarc-explained) is the record that turns email authentication from "detect spoofing" into " block spoofing." It's also the one people are scared to enable, because done carelessly it can send your own legitimate mail to the void. The secret is a staged rollout. Here's the safe path.

## What DMARC needs first

DMARC builds on SPF and DKIM — it tells receivers what to do when those checks fail. So before DMARC does anything useful:

Prerequisite Status to confirm

SPF record published Lists all your sending sources

DKIM signing enabled Your mail is signed

If SPF and DKIM aren't solid, fix those first ([full guide](/blog/spf-dkim-dmarc-explained)). DMARC without them does nothing helpful.

## The three policies

DMARC's p= tag controls what happens to mail that fails authentication:

Policy Effect Use when

p=none Monitor only — nothing blocked Starting out

p=quarantine Failing mail → spam folder Confident, ramping up

p=reject Failing mail → blocked entirely Fully validated

The whole game is moving safely from none to reject .

## The staged rollout

### Step 1: Publish p=none with reporting

Add a DMARC [TXT record](/blog/dns-record-types-explained) at p=none and turn on aggregate reports (the rua tag). This blocks nothing — it just starts sending you reports on who's sending mail as your domain.

p=none is your reconnaissance phase. It does no enforcement, so it's completely safe — but the reports reveal every source sending as you, including legitimate services you forgot about and spoofers. Don't skip it.

### Step 2: Read the reports

For a few weeks, study the reports. The goal: make sure all your legitimate mail passes SPF or DKIM. You'll often discover a forgotten sender (a CRM, a support tool, a payment provider) that needs adding to SPF/DKIM. Fix those gaps now — while nothing is being blocked.

### Step 3: Move to p=quarantine

Once you're confident your real mail passes, tighten to p=quarantine . Now failing mail goes to spam rather than the inbox. Consider starting with a percentage ( pct= ) to ramp gradually. Watch for any legitimate mail getting caught.

### Step 4: Move to p=reject

When quarantine has run cleanly, go to p=reject . Now spoofed mail is blocked outright — full protection against exact-domain [spoofing](/blog/domain-spoofing). This is the destination.

## A handy timeline

Phase Policy Duration (typical)

Monitor p=none 2–4 weeks

Soft enforce p=quarantine (ramp pct) 2–4 weeks

Full enforce p=reject Ongoing

## The cardinal rule

Never jump straight to p=reject . If a legitimate sender isn't covered by SPF/DKIM, reject will silently block your real mail — receipts, resets, the lot. Always go none → quarantine → reject, reading the reports at each step.

## A monitoring connection

Once enforced, DMARC must keep working. A DNS change that drops your SPF/DKIM, or a key rotation, can suddenly make your own mail fail under p=reject . [Monitoring your email policy records](/docs/monitors/email) catches that drift before it bins your email.

## The bottom line

Step In one line

Prereq Solid SPF + DKIM first.

1. p=none Monitor safely; read the reports.

2. p=quarantine Ramp enforcement; failing mail to spam.

3. p=reject Full protection; spoofing blocked.

DMARC is the difference between detecting spoofing and stopping it — but it rewards patience. Roll out none → quarantine → reject, fix every legitimate sender along the way, and you get airtight protection without ever losing your own email.

Related: [SPF, DKIM & DMARC](/blog/spf-dkim-dmarc-explained), [domain spoofing](/blog/domain-spoofing); check your DMARC with the free [DMARC checker](/dmarc-record-checker).

[#email](/blog/tag/email)[#security](/blog/tag/security)[#dns](/blog/tag/dns)

## Monitor your email deliverability

Keep SPF, DKIM, DMARC and MX records correct so your mail stays trusted and out of spam.

[Learn more](/email-monitoring)[Start free](/auth/sign-up)

Share this article

---

Canonical page: https://watchfor.io/blog/dmarc-setup-guide · Site guide: https://watchfor.io/llms.txt