How to configure DMARC
This guide explains what DMARC does, how to start with a monitoring policy that blocks nothing, and how to move to stricter policies safely.
Before you begin
- SPF and DKIM are set up first. See How to configure SPF and How to configure DKIM.
- A real mailbox that can receive DMARC reports.
- Access to the DNS settings of your domain.
APNCloud does not provide a DMARC value
The DMARC value depends on your domain, your reporting address and how far your rollout has progressed. The example below is for learning only. Choose your own reporting address.
DMARC checks alignment with the visible From domain. It passes when at least one aligned SPF or DKIM check passes. The domain’s policy guides receiver handling when neither aligned mechanism passes; delivery is still decided by the receiver.
Steps
- Start with a monitoring policy. It does not block any mail, and it sends you reports.
- Add a TXT record at the host
_dmarc, using the example below, with your own reporting mailbox. - Save the change and wait for it to spread.
- Read the reports for several weeks. Confirm that all of your legitimate senders pass.
- Move to a stricter policy only when you are sure. Change one level at a time.
Example for learning only
| Type | Host | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com |
The rua address must be a real mailbox you can read. The reports usually arrive as attachments, often in XML form.
A monitoring policy does not request DMARC-based quarantine or rejection; receivers can still filter mail using other checks. Aggregate reports are optional for receivers, so a valid record does not guarantee reports from every destination.
The policy levels
| Policy | Meaning | When to use it |
|---|---|---|
p=none | Monitor only, take no action | The first step, while you learn who sends mail for your domain |
p=quarantine | Send failing mail to spam | After your reports show that all legitimate senders pass |
p=reject | Reject failing mail | Only when you are sure every legitimate sender is authenticated |
Do not jump to reject
If you use p=reject before every legitimate sender is set up, real messages from your own tools may be blocked. Move up one level at a time.
Check the record
dig TXT _dmarc.yourdomain.com +shortExpected result
The lookup shows your DMARC policy, and reports begin to arrive at your reporting mailbox.
If something goes wrong
- No reports arrive. Check that the reporting address is a real mailbox and that the record spelling is correct. Reports can take time.
- Legitimate mail is blocked after a stricter policy. Return to
p=none, find the sender that fails, and fix its SPF or DKIM setup. - The record does not appear. Check that the host is
_dmarc, not_dmarc.yourdomain.comin a panel that adds the domain itself.
Related articles
Last reviewed
2026-10-28