Configure DMARC for enterprise email
DMARC helps receivers assess whether a message is authorized to use the domain in its visible From address. A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with that From domain. A policy tells receivers how to handle failures; it does not guarantee delivery or prevent every form of impersonation.
1. Inventory sending services
List your mail platform, marketing and support providers, application servers and delegated subdomains. Identify the owner of each stream and confirm that each provider can authenticate using your domain. Include infrequently used systems before enforcing a policy.
2. Set up SPF and DKIM
Authorize legitimate senders in SPF and configure DKIM signing with each provider. SPF checks the envelope identity, which can differ from the visible From domain; DKIM checks the signing domain. At least one successful result must align with the From domain. Forwarding can break SPF, so aligned DKIM is especially useful. Avoid publishing multiple SPF records for the same name and stay within SPF DNS lookup limits.
3. Monitor before enforcement
Publish one TXT record at _dmarc.example.com, replacing the example domain and report address with values you control:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comAggregate reports can expose legitimate senders that fail authentication or alignment. Protect and review the reports, investigate unknown sources, and correct configuration with each sender. If reports go to a different domain, the destination may need to authorize external reporting.
4. Enforce and continue monitoring
Once legitimate traffic aligns, plan a staged move to p=quarantine and then p=reject, with a rollback plan and continued report review. Test subdomain behavior and coordinate changes with mail owners; enforcement can affect legitimate mail if a sender is missed.
Use the DMARC lookup to inspect the published policy, the DKIM lookup to check a selector, and domain DNS lookup to inspect related records. DNS caches can delay visibility after a change.