DMARC Policy Configuration: Prevent Email Spoofing

What Is DMARC and Why You Need It Now#

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the enforcement layer for email authentication.

SPF and DKIM exist to prevent spoofing, but they have gaps. DMARC fills those gaps by:

1. Requiring SPF and DKIM to align (both pass AND sender domain matches)
2. Enforcing policy (reject spoofed emails)
3. Providing reporting (daily reports on authentication attempts)

In February 2026: Gmail and Yahoo require DMARC with p=quarantine or p=reject. Emails without proper DMARC go to spam or are rejected.

How DMARC Prevents Spoofing#

Without DMARC:

From: you@yourcompany.com
Mail-From: attacker.com
SPF-From: attacker.com

Email passes SPF (authorized on attacker.com) but appears to be from yourcompany.com. Spoofing works. ❌

With DMARC:

DMARC policy: p=reject
From: you@yourcompany.com
Mail-From: attacker.com
Result: REJECT (domains don't align)

Email is rejected because the visible "From" domain doesn't match the authenticated domain. ✅

DMARC Record Format#

DMARC record lives at: _dmarc.yourdomain.com

Basic format:

v=DMARC1; p=none; rua=mailto:admin@yourdomain.com

What each part means:

• v=DMARC1: Version (always this)
• p=none: Policy (none/quarantine/reject)
• rua=mailto:...: Where to send reports

DMARC Policies Explained#

Policy	What Happens	Email is	Use When
p=none	Monitor only	Delivered	Learning phase (week 1-2)
p=quarantine	Suspicious emails to spam	Delivered to spam	Testing (week 2-4)
p=reject	Spoofed emails blocked	Rejected completely	Production (week 4+)

p=none (Monitor-Only)#

v=DMARC1; p=none; rua=mailto:admin@yourdomain.com; ruf=mailto:forensics@yourdomain.com

What happens:

• Spoofed emails are still delivered
• You get daily reports on what would be rejected
• Use this for 1-2 weeks while you verify legitimate email isn't affected

Report contents:

• How many emails passed/failed SPF
• How many emails passed/failed DKIM
• Source IPs of failing emails
• Which services are legitimate vs suspicious

p=quarantine (Quarantine Policy)#

v=DMARC1; p=quarantine; rua=mailto:admin@yourdomain.com

What happens:

• Spoofed emails go to spam folder instead of inbox
• Users can still see them (with effort)
• You get reports

Use this for 1-2 weeks while testing that legitimate email still gets through.

p=reject (Hard Policy)#

v=DMARC1; p=reject; rua=mailto:admin@yourdomain.com

What happens:

• Spoofed emails are completely rejected
• Recipients never see them
• Attacker gets no signal that spoofing failed

Use this in production once you've verified with p=quarantine.

Step-by-Step DMARC Setup#

Step 1: Ensure SPF and DKIM Are Working#

DMARC requires SPF and DKIM to be configured first.

Verify both with: Nova Uptime Email Health Checker

If either fails, set them up first before adding DMARC.

Step 2: Create Reporting Email Address#

DMARC sends daily reports (could be hundreds of emails per day for large domains).

Create a dedicated email:

dmarc-reports@yourdomain.com

Or use your main admin email if you want the reports there.

Step 3: Publish DMARC Record#

Go to your DNS provider (Cloudflare, Route 53, GoDaddy, etc.)

Add TXT record:

• Name: _dmarc (exact)
• Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
• TTL: 3600

Save and wait 5-15 minutes for DNS propagation.

Step 4: Test DMARC Policy#

Option 1: Send test email

1. Send email from your domain
2. Check email headers for DMARC: PASS or DMARC: FAIL
3. Look for dmarc-reports@yourdomain.com (might take 24 hours)

Option 2: Use verification tool

• Nova Uptime Email Health Checker
• Enter your domain
• Check DMARC status

Step 5: Monitor Reports for 1-2 Weeks#

DMARC reports arrive daily (or aggregated weekly, depending on policy).

What to look for:

• Are all your legitimate emails passing?
• Any unexpected failing emails?
• Any spoofing attempts against your domain?

If everything passes: Move to p=quarantine

Step 6: Switch to p=quarantine (Week 3)#

After confirming no legitimate email is failing:

Update DNS TXT record:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

Monitor for 1-2 weeks again.

Step 7: Switch to p=reject (Week 5+)#

Once satisfied with quarantine results:

Update DNS TXT record:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:forensics@yourdomain.com

Now you're fully protected.

DMARC Subdomain Policy#

By default, DMARC only applies to yourdomain.com. If you send from subdomains like mail.yourdomain.com, you need subdomain policy:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; sp=none

• sp=none: Subdomains are monitored only, not rejected
• Or set sp=quarantine or sp=reject depending on your needs

Common DMARC Mistakes#

Mistake 1: SPF/DKIM Not Aligned#

Example:

• From: you@yourdomain.com
• SPF passes for: mail.yourdomain.com (different subdomain)
• Result: DMARC fails (not aligned)

Fix: Use relaxed alignment in DMARC:

aspf=r; adkim=r

This allows subdomains to pass. (Not recommended for security, but sometimes necessary.)

Mistake 2: Never Receiving Reports#

Email address in rua= doesn't exist or emails go to spam.

Fix:

• Verify the email address exists
• Check spam folder for dmarc@yourdomain.com reports
• Whitelist the report sender in email

Mistake 3: Jumping Straight to p=reject#

Jumping from p=none to p=reject causes legitimate email to fail.

Fix: Use the progression: p=none → p=quarantine → p=reject over 4-6 weeks.

Mistake 4: Not Watching for Changes#

You add a new email service (Zapier, CRM, etc.) that sends email, but forget to update SPF/DKIM. DMARC rejects it.

Fix: Monitor DMARC reports monthly. Add new services as they're added to your infrastructure.

Monitoring DMARC#

Weekly:

• Check DMARC reports for unexpected failures
• Add new sending services to SPF/DKIM as needed

Monthly:

• Review report trends
• Identify any spoofing attempts against your domain
• Verify policy is still appropriate

DMARC Reports: Understanding Them#

DMARC reports include:

• Domain: Which domain is being reported on
• Source IP: Where emails came from
• Pass/Fail counts: SPF/DKIM pass/fail rates
• Policy evaluated: What would happen at p=reject

Use this to validate that:

1. Your legitimate services are passing
2. No unexpected IPs are sending email
3. Spoofing attempts are being detected

The Full Authentication Stack#

SPF: "Is the server authorized?" DKIM: "Is the message authentic?" DMARC: "Do both pass AND does the domain align?"

All three together = proper email authentication.

Check all three automatically: Nova Uptime Email Health Checker. Free. 🚀

Summary#

1. Verify SPF and DKIM work first
2. Publish DMARC with p=none (week 1-2)
3. Move to p=quarantine (week 3-4)
4. Move to p=reject (week 5+)
5. Monitor reports continuously
6. Update when adding new email services

DMARC is mandatory in 2026. Your competitors are already set up. Don't lag behind.

Frequently Asked Questions#

How do I test my DMARC record?#

Use a free DMARC checker tool to validate your record. It verifies syntax, checks policy settings, confirms reporting addresses, and identifies common configuration errors. You can also test by sending an email and checking the DMARC header in the received message.

What is the difference between p=quarantine and p=reject?#

With p=quarantine, emails failing DMARC are delivered to the spam folder. With p=reject, they are blocked entirely and never delivered. Start with quarantine to catch issues before moving to reject for maximum protection against spoofing.

Do I need DMARC if I already have SPF and DKIM?#

Yes. SPF and DKIM authenticate email but do not tell receiving servers what to do when authentication fails. DMARC provides the enforcement policy and enables reporting so you can monitor authentication results across all your email.

Can DMARC break my email?#

Only if misconfigured. A p=reject policy applied before all legitimate senders are authenticated will block your own email. Always start with p=none, review reports for 2-4 weeks, fix any authentication gaps, then gradually increase enforcement.

Related Reading#

• DMARC Setup: None to Reject — Step-by-step DMARC implementation
• How to Configure SPF Records — SPF setup that DMARC requires
• DKIM Check & Setup Guide — DKIM configuration for DMARC alignment
• Email Health Checker Guide — Comprehensive email authentication analysis
• Free DMARC Checker — Validate your DMARC record instantly