Rolling it out
From p=none to p=reject without blocking real email
- Publish p=none with a reporting address. Nothing changes for delivery; you start getting daily reports.
- Read the reports for two to four weeks. Fix SPF or DKIM for every service that sends as your domain and fails.
- Move to p=quarantine, optionally at a lower pct first, and watch for problems.
- Move to p=reject. Fake email in your name is now refused. Confirm with the DMARC checker.
Questions
DMARC generator FAQ
Where do I add a DMARC record?
At your DNS host, as a TXT record named _dmarc (some hosts want the full name, _dmarc.yourdomain.com). Paste the generated value exactly, then check it with the free DMARC checker.
Which DMARC policy should I start with?
Start with p=none and a reporting address so you can see who sends email as your domain. Once every real sender passes SPF or DKIM, move to quarantine and then reject.
What does pct do?
It applies your policy to only a share of failing mail, so you can move to quarantine or reject gradually. Leave it at 100% once you're confident.
Can I have more than one DMARC record?
No. A domain must have exactly one DMARC record. Two records make receivers ignore DMARC for your domain entirely.