How to set up DMARC: record examples from p=none to reject

Steps#

1. 1

   Check SPF and DKIM first

   List every service that sends with your domain in the From address and confirm each passes SPF or DKIM for your own domain. Google suggests setting up both at least 48 hours before DMARC ^S3.

2. 2

   Pick a mailbox for reports

   Create an address such as dmarc@ninefold.example, or use a report service. Reports arrive as compressed XML files ^S2.

3. 3

   Publish a monitoring record

   Add a TXT record with the host _dmarc and the value v=DMARC1; p=none; rua=mailto:dmarc@ninefold.example. A policy of none does not change how mail is handled ^S1.

4. 4

   Verify the record

   Run dig +short TXT _dmarc.ninefold.example or use a DNS lookup tool, and check that exactly one record comes back and it starts with v=DMARC1.

5. 5

   Read the reports

   Review the aggregate reports until every legitimate sender shows aligned SPF or DKIM. Google suggests at least a week; RFC 9989 suggests about a month before enforcing ^S1S3.

6. 6

   Move to quarantine

   Change the policy to p=quarantine, so mail that fails goes to spam. Keep reading reports.

7. 7

   Move to reject

   After a similar period with clean reports, change the policy to p=reject, so receivers refuse mail that fails ^S1.

What you need before you start#

DMARC does not authenticate anything by itself. It reads the SPF and DKIM results and checks that at least one of them passed for a domain that aligns with the visible From address ^S1. If your marketing tool signs with its own domain instead of yours, DMARC fails even though DKIM passed. Fix that first, or the reports will be full of your own mail.

For a small apparel brand like Ninefold, the list of senders usually covers the staff mailbox, order and shipping emails from the store platform, the help desk and the email marketing tool. Each needs SPF or DKIM set up on ninefold.example. The SPF, DKIM and DMARC explainer covers how each record works.

Gmail requires a DMARC record from senders of more than 5,000 messages a day to personal Gmail accounts, and a policy of none is accepted ^S4. Yahoo asks bulk senders for at least p=none as well ^S5. The record takes minutes to publish, so it is worth adding at any volume.

DMARC record syntax#

A DMARC record is a TXT record published at _dmarc on your domain. It is a list of tags separated by semicolons. The v=DMARC1 tag must come first, or receivers ignore the whole record ^S1. These are the tags a shop needs:

Leave out adkim and aspf unless you have a reason. Relaxed alignment, the default, lets mail signed by a subdomain such as mail.ninefold.example align with a From address at ninefold.example ^S1, and Yahoo accepts relaxed alignment ^S5.

DMARC record examples for each stage#

These examples use ninefold.example. Replace the domain and the report address with your own, and publish each one under the host _dmarc.

Monitoring

v=DMARC1; p=none; rua=mailto:dmarc@ninefold.example

Quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc@ninefold.example

Reject

v=DMARC1; p=reject; np=reject; rua=mailto:dmarc@ninefold.example

Older guides, including Google’s rollout page, use pct= to enforce on a percentage of mail ^S3. RFC 9989 removed the tag because receivers applied it reliably only at 0 or 100, and added t=y for a testing period instead ^S1. Receivers must ignore tags they do not know, so one that does not support np or t yet simply skips them ^S1.

What the rua reports tell you#

Mailbox providers that send aggregate reports usually send one a day per domain, as a compressed XML file ^S2. Each report lists the IP addresses that sent mail using your domain, how many messages came from each, the SPF and DKIM results, whether they aligned, and what the receiver did with the mail ^S2.

• A source you recognize that fails alignment is a sender you forgot to set up. Turn on DKIM for your domain in that service, or add it to SPF.
• A source you do not recognize is either a service someone on your team signed up for, or someone spoofing your domain. Ask around before you enforce.
• Forwarded mail often fails SPF and passes DKIM ^S1. That is expected, and one reason aligned DKIM matters most.

Raw XML is hard to read by hand, so many shops send rua to a report service that turns it into charts. If that service uses another domain, it must publish an authorization record, or receivers ignore the address ^S2. Report services set this up on their side.

Moving from p=none to quarantine to reject#

The order is always the same: monitor, then quarantine, then reject. What varies is how long each stage lasts. Google suggests at least a week at none ^S3. RFC 9989 suggests at least a month at none and a similar period at quarantine before reject ^S1. A shop with a handful of senders and clean reports can move faster than one with a dozen tools.

Before each change, check the last week of reports for failing sources you recognize. If staff post to mailing lists from the shop domain, RFC 9989 advises against p=reject: list mail rejected by receivers causes problems for the list and can get subscribers removed ^S1. Quarantine is a reasonable place to stop in that case.

DMARC for subdomains#

Without its own record, a subdomain such as news.ninefold.example uses the policy on ninefold.example. Use sp to give existing subdomains a different policy, and np for names that do not exist, which are a common way to spoof a brand ^S1.

Some shops send marketing email from a subdomain to keep it separate from staff mail. That subdomain can have its own _dmarc record. RFC 9989 describes testing a subdomain with p=quarantine; t=y, then switching to p=reject and removing the testing flag ^S1.

Setting up DMARC with Tellnod in Claude or ChatGPT#

Tellnod is an MCP connector for writing, previewing and sending marketing email from Claude or ChatGPT. You can send right away from an address on Tellnod’s shared domain, such as hello@yourshop.tellnodmail.com, within limits of 500 recipients per campaign and 1,000 emails a month. Verifying your own domain lifts those limits.

Ask in the chat: “Set up ninefold.example as my sending domain.” Tellnod gives you the SPF, DKIM and DMARC records and checks them for you. If someone else manages your DNS, ask for a setup link to send them: they can add the records in one click on supported providers, or copy them, without creating an account. You are notified in the chat and by email when the domain is verified. If you already have a DMARC record, keep one record only and make sure your Tellnod mail aligns before you tighten the policy.

Every campaign still goes through a desktop and mobile preview and a confirmation card that only you can press. Connect Tellnod to start on the free plan, or compare plans on the pricing page. For the rest of what Gmail and Yahoo expect, see the deliverability basics.

FAQ#