In short
Setting up DMARC means listing every service that sends as your domain, making each pass SPF or DKIM aligned, then publishing v=DMARC1; p=none with a rua address and reading the reports before you enforce. The NCSC says reports start within 24 hours and many organisations move on from p=none after about 6 to 8 weeks.
Want help with DMARC set-up?
We can plan it with you or do it for you. Tell us where you are up to.
DMARC setup in six steps
This is the order RFC 9989 section 5.1 (opens in a new tab) sets out for domain owners, with the NCSC's timings from its email security and anti-spoofing (opens in a new tab) guidance.
- List every service that sends as your domain. Include your mailbox provider (such as Microsoft 365 or Google Workspace), email marketing and CRM platforms, helpdesk and finance systems, website forms, printers and scanners, and any on-premises servers. Ask each department; the reports will catch the ones you miss
- Make sure each one passes SPF or DKIM (opens in a new tab), aligned. Add each service to your SPF record and turn on DKIM signing with your own domain. RFC 9989 asks for "at least one -- preferably two" aligned identifiers per message. See SPF, DKIM and DMARC explained
- Publish a DMARC record at p=none with a rua address. For example v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk, at _dmarc.example.co.uk. Build yours with the DMARC generator
- Confirm it is live with the DMARC checker, which reads the record as a receiver would
- Receive and read the aggregate reports. The NCSC (opens in a new tab) says that "within 24 hours of publishing your records you'll start receiving email reports from major email recipient domains". Use them to find and fix every unaligned sender. See DMARC reports
- Move to quarantine, then reject where it suits the domain. Step the policy up once the reports show your legitimate mail passing. See DMARC policy
Steps 1 to 4 are usually quick, though some DNS hosts take up to 48 hours to publish a change. Steps 5 and 6 take weeks, because senders that mail rarely, such as quarterly invoicing or an annual newsletter, only appear in the reports when they send.
How to add a DMARC record at your DNS host
Adding a DMARC record is the same at every DNS host: a new TXT record with the host name _dmarc and your record as the value. Make the change wherever your domain's DNS is hosted, which is not always where you bought the domain.
| Field | Value | Notes |
|---|---|---|
| Type | TXT | |
| Host, name or hostname | _dmarc | Most panels add your domain automatically; if the field wants the full name, use _dmarc.example.co.uk |
| Value, content or text | v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk | Start with v=DMARC1; and use your own report address |
| TTL | Default | Leave as your host suggests unless you need faster changes |
Add a DMARC record in 123 Reg
123 Reg's guide to setting up a TXT record (opens in a new tab) gives these steps. Your domain must use 123 Reg's nameservers for the change to take effect, and 123 Reg says DNS changes take 24 to 48 hours to become active.
- Log in to the 123 Reg Control Panel
- Select Manage All opposite Domains, then choose your domain
- Select DNS in the navigation bar, then Add New Record
- Set Type to TXT, Name to _dmarc and Value to your DMARC record
- Leave TTL as Default and select Save
one.com DMARC records
one.com's help article How do I create a DMARC record? (opens in a new tab) says a standard one.com DMARC record is enabled automatically for newer domains, and can be switched on under Standard DNS settings if it is not. To use your own policy and report address, add a custom record: in the Control Panel go to Domains, DNS settings, DNS records, choose TXT under Create new record, enter _dmarc as the hostname and your record as the value, then select Create record. one.com notes that creating a custom record disables its standard one, because "your domain should only have one DMARC record".
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
DMARC settings to choose
A first DMARC record only needs three settings, but it is worth deciding the rest up front.
| Setting | Tag | Recommended starting choice | When to change it |
|---|---|---|---|
| Policy | p | none | Move to quarantine once the reports show your legitimate senders passing, then to reject where it suits the domain |
| Aggregate report address | rua | A dedicated mailbox or your monitoring platform's address | Add a second address, comma-separated, if you change platform |
| Failure report address | ruf | Leave out at first | Add if you need per-message detail, bearing in mind it can contain personal data |
| Subdomain policy | sp | Leave out (inherits p) | Set when subdomains should move faster or slower than the main domain |
| Non-existent subdomain policy | np | Leave out, or reject once the main domain is enforced | Set to reject to block spoofing of made-up subdomains |
| Alignment | adkim, aspf | Leave out (relaxed) | Strict only where you control every sender on that domain |
| Test mode | t | Leave out | Use t=y for a trial period when you first publish quarantine or reject |
Receivers that have not yet adopted RFC 9989 ignore t and apply your stated policy in full, so only publish quarantine or reject once the reports show your senders passing. If your record has pct below 100, removing it applies the full policy everywhere, so step p down a level first rather than just deleting pct.
Every tag is explained in DMARC record explained. One point the NCSC stresses: start at p=none, which "does not interfere with your email traffic in any way" (NCSC (opens in a new tab)).
How long DMARC setup takes
Publishing the record is minutes; reaching enforcement takes longer, and the pace is set by your reports rather than a calendar. The NCSC's published experience is a useful guide:
| Stage | NCSC guidance |
|---|---|
| Reports start | "Within 24 hours of publishing your records" (implement p=none (opens in a new tab)) |
| p=none to p=quarantine | "Many organisations report being able to move on from a DMARC policy of 'none' after about 6 to 8 weeks" (mark spoof emails as spam (opens in a new tab)) |
| Monitoring at quarantine | "Monitor your reports for at least 4 weeks" |
| p=quarantine to p=reject | "Many organisations report being able to move on from a DMARC policy of 'quarantine' to one of 'reject' after about 3 months" (reject spoof emails (opens in a new tab)) |
| After moving to reject | "Closely monitor your reports for at least a 2-week period" |
RFC 9989 section 5.1.7 (opens in a new tab) adds that, depending on how often a domain sends, "it may take many months of consuming DMARC aggregate reports" before the owner is sure all its mail is authenticated. For domains whose users post to mailing lists, section 7.4 (opens in a new tab) advises at least a month at p=none and an equally long period at p=quarantine before considering reject. The NCSC pages still describe stepping up with pct, which RFC 9989 has made historic; t=y now does the trial-period job at receivers that follow RFC 9989, with the caveat for older receivers set out under the DMARC settings above.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Setting up SPF, DKIM and DMARC together
If you are starting from nothing, set up SPF and DKIM first, then DMARC. DMARC published before them is safe at p=none, and its reports will tell you which senders still need work.
| Record | Published at | Typical value | Set up in |
|---|---|---|---|
| SPF | Your domain (or the bounce domain each service uses) | v=spf1 include:(your providers) ~all | Your DNS host, using each provider's include |
| DKIM | selector._domainkey.yourdomain | A public key, or a CNAME to the provider's key | Each sending service's admin settings, then your DNS host |
| DMARC | _dmarc.yourdomain | v=DMARC1; p=none; rua=mailto:... | Your DNS host |
The platform guides cover the details for Microsoft 365, Google Workspace and email marketing platforms. gov.uk's set-up guidance (opens in a new tab) for public sector bodies asks for SPF "using a minimum soft fail (~all) qualifier" and suggests a separate subdomain for third-party email services to keep SPF and DKIM manageable.
Prefer a hand with DMARC setup?
The DNS change is quick; the weeks of reading reports and chasing unaligned senders are where outside help saves time. We can:
- Assess your domains: review DMARC, SPF and DKIM on every domain you own, parked ones included, and map the services sending as you
- Set up reporting: point your rua tag at a monitoring platform and check that reports arrive
- Choose and supply the platform: we supply EasyDMARC, Valimail and the Check Point Email Security DMARC Management add-on, and help you choose the one that fits
- Plan your route to enforcement: help you fix each sender and plan every policy step, domain by domain
Our DMARC management page explains the work in more detail. Licences can be billed monthly, with terms confirmed at quote. Contact us for free advice.
DMARC set-up by platform
Frequently asked questions
How long does DMARC setup take?
Publishing a p=none record takes minutes, and the NCSC says reports start within 24 hours. Reaching enforcement takes longer: the NCSC reports many organisations move from none to quarantine after about 6 to 8 weeks and from quarantine to reject after about 3 months. RFC 9989 notes it can take many months for domains that send infrequently.
Can adding DMARC at p=none break email?
No. The NCSC describes p=none as a monitoring phase that "does not interfere with your email traffic in any way": receivers deliver your mail as before and simply send you reports. Delivery only changes when you move to quarantine or reject, which is why you read the reports first.
How do I add a DMARC record in 123 Reg?
Log in to the 123 Reg Control Panel, select Manage All opposite Domains and choose the domain, select DNS, then Add New Record. Choose TXT, enter _dmarc as the name and your record, such as v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk, as the value, and save. The domain must use 123 Reg's nameservers.
Where do I add a DMARC record?
At whichever provider hosts your domain's DNS, which may be your registrar, your web host, a service such as Cloudflare or your IT provider. Look up your domain's nameservers to find it, then add a TXT record with the host _dmarc there. A record added anywhere else will not be seen by receivers.
Do I need a DMARC record for every domain?
Yes. The NCSC says all of your domains, including parked domains, should have DMARC records, whether or not they send email. Domains that send no email can usually go straight to v=DMARC1; p=reject; sp=reject; np=reject. Subdomains are covered by their organisational domain's record unless you give them their own.
What should I use as the rua address?
A mailbox that can cope with automated XML reports, or the reporting address of a DMARC monitoring platform. one.com, for example, recommends a dedicated address with spam filtering switched off. Raw reports are designed for machines, so most organisations send them to a platform that turns them into named senders and pass rates.
Still have a question about DMARC set-up?
Ask us and a member of our team will get back to you.