Email security · checked 15 October 2026
How to set up a DMARC record
DMARC is one line of DNS text that tells Gmail, Outlook and Yahoo what to do with email that claims to be from your domain but isn't. It takes ten minutes to add, and it's now required if you send more than 5,000 emails a day to Gmail, Yahoo or Outlook.com.
Before you start
DMARC builds on SPF and DKIM, so check those first. Our free check shows all three for your domain. If you use Google Workspace or Microsoft 365, turn on DKIM in their admin panel before adding DMARC, or some of your own email may fail.
The record to add
| Field | Value |
|---|---|
| Type | TXT |
| Name | _dmarc (some hosts want _dmarc.yourcompany.com) |
| Value | v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com |
| TTL | Default or 1 hour |
Use a mailbox you can read for rua, or a free DMARC report service's address. A domain can have only one DMARC record; two records means neither works.
Where to add it
- Cloudflare: your domain → DNS → Records → Add record → TXT, Name
_dmarc. - GoDaddy: My Products → your domain → DNS → Add New Record → TXT, Name
_dmarc. - Namecheap: Domain List → Manage → Advanced DNS → Add New Record → TXT Record, Host
_dmarc. - Other hosts: look for "DNS records" or "zone editor" and add a TXT record with the same name and value.
Changes usually show within an hour. Run the free check again to confirm it's found.
What the tags mean
| Tag | Meaning |
|---|---|
p=none | Watch only. Fake email is still delivered, but you get reports. |
p=quarantine | Failing email goes to spam. |
p=reject | Failing email is refused. This is what actually stops spoofing. |
rua= | Where daily summary reports are sent. |
pct= | Apply the policy to only part of failing mail, for a gradual rollout. |
sp= | A separate policy for subdomains. |
From p=none to p=reject
- Weeks 1 to 4: stay on
p=noneand read the reports. They're XML files; a free report viewer turns them into a list of every service sending as your domain. - For each legitimate sender you didn't know about (newsletter tool, invoicing app, website contact form, CRM), add it to SPF or set up DKIM in that service.
- Move to
p=quarantine, optionally withpct=25and then 100. - When reports show only your own services passing, move to
p=reject.
Don't send email from your domain at all? Publish v=DMARC1; p=reject straight away, together with an SPF record of v=spf1 -all, so nobody can use it.
Why it matters
Google and Yahoo have required DMARC from bulk senders since February 2024, and Microsoft's Outlook.com since May 2025. Without it, your invoices and newsletters are more likely to land in spam, and anyone can send fake invoices that appear to come from you. How email spoofing works.
Sources: RFC 7489 (DMARC); Google Email sender guidelines; Yahoo Sender Hub; Microsoft Defender for Office 365 blog on Outlook.com bulk sender requirements (April 2025). Read 15 October 2026.