Defaults.Exposed › Fixes › DMARC (Email Spoofing Protection)

How to fix DMARC

Updated 17 October 2026, figures from the October 2026 census, snapshot 2026-10-12.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the one setting that tells the world's mail providers to BLOCK emails that fake your business's name. SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) check the locks; DMARC decides what happens when a forgery fails the check: reject it, send it to spam, or deliver it anyway. At the strictest setting, forged email never reaches the inbox.

249,025,625 of the 332,492,319 domains carrying a grade publish no DMARC record at all: 74.9%.

Counted over the 332,492,319 graded and dead domains that carry every grade share in this edition.

Without DMARC enforcement, a criminal can send email that looks exactly like it came from your business (to your customers, staff and suppliers) and it lands in their inbox rather than their spam. People get scammed in your name.

Why DMARC matters

Email was never built to prove who sent it, so faking the 'from' address is trivial. DMARC is the only control that turns 'we can detect fakes' into 'fakes get blocked', and it also gives you the daily reports that reveal who is sending mail as your brand. Big mailbox providers now treat a missing or unenforced DMARC policy as a trust signal against you, so this affects whether your own email is delivered too.

Fixing DMARC, in order

1. Get SPF or DKIM in place first. DMARC builds on them; make sure at least one is set up and aligned before you start.
2. Publish a monitoring record. Add a TXT (Text) record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:you@yourdomain to collect reports without affecting delivery.
3. Read the reports. Over a week or two, use the aggregate reports to confirm all your legitimate mail passes.
4. Move to quarantine. Once legitimate mail passes cleanly, raise the policy to p=quarantine so spoofed mail goes to spam.
5. Enforce with reject. Finally set p=reject so forged email is refused outright, the setting that stops impersonation.

What DMARC is, in plain words

The “from” line of an email is just typed-in text. Anyone, anywhere, can write your business name and address into the “from” field of an email and send it. The internet was never designed to stop them.

There are three settings that, together, fix this. They work like a building’s security:

• SPF is a list of who’s allowed in the front door (which mail services may send as you).
• DKIM is a tamper-proof seal that proves the message wasn’t altered in transit.
• DMARC is the security guard who checks the list and the seal, then decides what to do when they don’t match: let it through, send it to spam, or turn it away at the door.

You can have the list (SPF) and the seal (DKIM) and still have no guard. That’s the common and dangerous situation: the locks exist, but nothing enforces them. DMARC is the enforcement: with it at reject, the fake email never reaches your customer.

What this can cost you

These are the ways an unprotected domain costs you money and reputation:

1. A criminal emails your customer what looks exactly like a genuine invoice from your accounts team (same name, same domain, professional layout) but with their own bank details. Because your domain isn’t enforced, it lands in the inbox instead of spam. The customer pays. You discover it weeks later when they ask where their order is. The money is usually gone, and the customer often holds you responsible for the breach.

2. An email appears to come from you, the owner, to your finance person: “Can you push this payment through urgently, I’m in a meeting.” It looks completely real because it is your address, just forged. The payment goes out. This pattern (Business Email Compromise) is one of the costliest scams hitting small businesses, precisely because the email comes from your own domain, so it sails straight past suspicion.

3. A prospect’s pre-signing security check reports your domain as “spoofable, no email authentication enforcement.” The contract can go to a competitor whose domain passed.

4. Your domain gets swept into a phishing campaign. Dozens of people who were tricked in your name post warnings and reviews. Customers are still asking whether you’re safe months after the week-long attack ends.

5. Google and Yahoo now actively distrust domains with no enforced DMARC. Quotes, invoices and replies that you sent start quietly landing in spam folders, and deals stall.

The record, and what “good” looks like

DMARC lives as a single line of text in your domain’s settings, a DNS (Domain Name System) “TXT” record published at the special name _dmarc.yourdomain. Inside it are a few short instructions. Two of them matter most, and they’re exactly the two things this assessment checks.

1. The policy (p=): the guard’s orders. This is the heavily-weighted part of the check. It can be one of three things:

• p=none: watch only. The guard notes who came through but stops nobody. This protects you against nothing; it’s a monitoring stage rather than a finished setup. (Our engine scores this as a fail. It’s better than no DMARC at all, but it gives no protection.)
• p=quarantine: send fakes to spam. The fakes still sit in spam folders, and a determined attacker is counting on someone checking there. A solid stepping stone that earns roughly half marks.
• p=reject: refuse fakes at the door. The forged email is never delivered. This is the only setting that fully protects you and earns full marks.

What “good” looks like: p=reject. Anything less leaves a gap.

Two technical details our check also looks at, worth knowing so you don’t get caught out:

• The subdomain policy (sp=). You can set a strong policy for your main domain but accidentally leave subdomains (like mail.yourdomain or news.yourdomain) wide open. Our engine penalises this hard. A domain with p=reject but sp=none is scored down close to having no enforcement at all, because attackers will simply spoof a subdomain instead. Good practice is to let sp inherit your strong main policy, or set it to reject explicitly.
• The percentage (pct=). During a careful rollout you can apply enforcement to only a fraction of mail (e.g. pct=25). That’s a legitimate transition tool, but a partial rollout only gives partial protection, and our score reflects that: it rises steadily as you move from 25% toward 100%, but full marks need full coverage.

2. The reporting address (rua=): your visibility. This is the second check on this page. The rua= tag asks every mail provider in the world to send you a daily summary of who tried to send email as your domain: your own systems and any impersonators. Without it, you are flying blind: you have no idea who is abusing your name. With it, businesses routinely discover between 5 and 50 unauthorised senders on the very first day.

What “good” looks like for reporting: a valid rua=mailto: address (or a reporting-service https: URL) that receives the reports. Our check validates the format. A mistyped or malformed address means the reports silently go nowhere, which scores as a partial or failed result even though a tag is technically “present.”

How to fix it (free, ~30 minutes spread over two weeks)

Hand this section to whoever manages your domain, website, or IT. The fix is completely free. If you want the exact steps for your own domain, in the safe order, the A-Grade Playbook sets them out.

Never jump straight to reject. Turn on monitoring first, watch the reports, confirm your real mail is recognised, then tighten. Done in this order it is safe; done in a rush it can junk your own email.

Step 1: Make sure SPF and DKIM are in place first. DMARC relies on them. If either is missing, sort those before enforcing DMARC (see the SPF and DKIM pages).

Step 2: Publish a monitoring record with reporting on. Add a DNS TXT record:

• Host / name: _dmarc.yourdomain (your DNS provider may show this as just _dmarc)
• Type: TXT
• Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain; adkim=s; aspf=s

This watches and reports without blocking anything yet. The adkim=s; aspf=s parts request strict alignment. Leave them out at first if you’re unsure, and add them once your mail is confirmed clean.

Step 3: Read the reports for ~2 weeks. Raw DMARC reports are dense XML. Use a free reporting service (for example dmarcian or Postmark’s free DMARC tool) to turn them into a readable dashboard. Confirm that every legitimate sender (your mailbox provider, newsletter tool, CRM, helpdesk, invoicing app) is passing. Fix any genuine sender that isn’t.

Step 4: Move to quarantine. Once your real mail is clean, change p=none to p=quarantine. Watch for another few days.

Step 5: Move to reject. Finally change p=quarantine to p=reject. You’re now fully protected. The final record looks like:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain; adkim=s; aspf=s

Step 6: Don’t forget subdomains. Make sure you haven’t left sp=none in place. If you publish no sp at all, subdomains inherit your main p= policy, which is what you want.

Notes per common platform:

• Google Workspace / Microsoft 365: Both fully support DMARC. The DMARC record itself goes in your DNS provider rather than in Google or Microsoft’s admin console. Make sure SPF and DKIM are enabled in the admin console first, then publish the DMARC TXT record at your registrar/DNS host.
• Cloudflare: DNS > Records > Add record > TXT, name _dmarc, paste the value. Cloudflare also offers built-in DMARC management that can set this up and collect the reports for you.
• Common hosts / registrars (Blacknight, GoDaddy, etc.): Look for “DNS”, “DNS Zone”, or “Advanced DNS”, then add a TXT record with name _dmarc and the value above. Propagation usually takes a few minutes to an hour.

Common mistakes

• Stopping at p=none. The most common error by far. Monitoring is only the start: a domain stuck on none is still fully spoofable. Our engine scores it as a fail for exactly this reason.
• Jumping straight to reject without monitoring. The opposite mistake. Without the reporting stage you may not realise a legitimate sender (often a newsletter or invoicing tool) isn’t aligned, and you’ll start blocking your own mail.
• Forgetting the subdomain policy. A strong p=reject with sp=none leaves a side door wide open; attackers just spoof a subdomain instead.
• A broken reporting address. A mistyped rua= (or one missing the mailto: prefix) means the reports go nowhere and you stay blind without realising it. The format has to be a valid mailto: or https: URI, or the reports are never delivered.
• “We don’t send email so we’ll skip it.” A non-sending domain is a prime target precisely because nobody is watching it. Publish a strict reject policy to lock it down entirely.

A note on grading

The policy check (p=) is one of the heaviest-weighted items in the whole assessment, because it’s the single biggest factor in whether your business can be impersonated. reject earns the full score; quarantine earns roughly half; none fails the check but still earns about a quarter of its points; a missing record earns nothing. A weaker subdomain policy or a partial pct= rollout pulls the score down to match the real level of protection you have.

The reporting check (rua=) is scored too, and it is the tool that lets you reach reject safely. Set it up at the same time as your monitoring record, and it pays for itself in visibility on day one.

Where the change goes, host by host

The click path for the providers people ask about most:

• Set up DMARC on AWS Route 53
• Set up DMARC on Cloudflare
• Set up DMARC on GoDaddy
• Set up DMARC on Google Workspace
• Set up DMARC on Hostinger
• Set up DMARC on Microsoft 365
• Set up DMARC on REG.RU
• Set up DMARC on Timeweb
• Set up DMARC on Wix

Common situations

• DMARC fails but SPF and DKIM pass
• p=none, p=quarantine, p=reject: what each one tells a receiver
• DMARC quarantine/reject policy not enabled: answering the scanner finding
• Newsletter emails failing DMARC
• Someone is sending emails from my domain

Questions people ask

Figures as of 12 October 2026, from the October 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.