# How to set up DMARC: record examples from p=none to reject > To set up DMARC, make sure SPF and DKIM pass for every service that sends as your domain, publish a TXT record at _dmarc.yourdomain such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain, read the daily reports for a few weeks, and then tighten the policy to quarantine and finally reject. Canonical: https://tellnod.com/guides/how-to-set-up-dmarc Last updated: 2026-10-22 Author: Tellnod team ## Steps 1. **Check SPF and DKIM first.** List every service that sends with your domain in the From address and confirm each passes [SPF](https://tellnod.com/glossary#spf) or [DKIM](https://tellnod.com/glossary#dkim) for your own domain. Google suggests setting up both at least 48 hours before DMARC [S3]. 2. **Pick a mailbox for reports.** Create an address such as dmarc@ninefold.example, or use a report service. Reports arrive as compressed XML files [S2]. 3. **Publish a monitoring record.** Add a TXT record with the host `_dmarc` and the value `v=DMARC1; p=none; rua=mailto:dmarc@ninefold.example`. A policy of none does not change how mail is handled [S1]. 4. **Verify the record.** Run `dig +short TXT _dmarc.ninefold.example` or use a DNS lookup tool, and check that exactly one record comes back and it starts with v=DMARC1. 5. **Read the reports.** Review the aggregate reports until every legitimate sender shows aligned SPF or DKIM. Google suggests at least a week; RFC 9989 suggests about a month before enforcing [S1][S3]. 6. **Move to quarantine.** Change the policy to `p=quarantine`, so mail that fails goes to spam. Keep reading reports. 7. **Move to reject.** After a similar period with clean reports, change the policy to `p=reject`, so receivers refuse mail that fails [S1]. ## What you need before you start [DMARC](https://tellnod.com/glossary#dmarc) does not authenticate anything by itself. It reads the SPF and DKIM results and checks that at least one of them passed for a domain that aligns with the visible From address [S1]. If your marketing tool signs with its own domain instead of yours, DMARC fails even though DKIM passed. Fix that first, or the reports will be full of your own mail. For a small apparel brand like Ninefold, the list of senders usually covers the staff mailbox, order and shipping emails from the store platform, the help desk and the email marketing tool. Each needs SPF or DKIM set up on ninefold.example. The [SPF, DKIM and DMARC explainer](https://tellnod.com/guides/spf-dkim-dmarc-explained) covers how each record works. > Gmail requires a DMARC record from senders of more than 5,000 messages a day to personal Gmail accounts, and a policy of none is accepted [S4]. Yahoo asks bulk senders for at least p=none as well [S5]. The record takes minutes to publish, so it is worth adding at any volume. ## DMARC record syntax A DMARC record is a TXT record published at `_dmarc` on your domain. It is a list of tags separated by semicolons. The `v=DMARC1` tag must come first, or receivers ignore the whole record [S1]. These are the tags a shop needs: | Tag | Example | What it does | | --- | --- | --- | | v | v=DMARC1 | Version; must come before every other tag | | p | p=none | Policy for your domain: none, quarantine or reject | | rua | rua=mailto:dmarc@ninefold.example | Where to send daily aggregate reports | | sp | sp=reject | Policy for existing subdomains, if different from p | | np | np=reject | Policy for subdomains that do not exist | | adkim / aspf | adkim=r | DKIM and SPF alignment: relaxed (default) or strict | | t | t=y | Testing: asks receivers to apply one level less than the stated policy | Leave out `adkim` and `aspf` unless you have a reason. Relaxed alignment, the default, lets mail signed by a subdomain such as mail.ninefold.example align with a From address at ninefold.example [S1], and Yahoo accepts relaxed alignment [S5]. ## DMARC record examples for each stage These examples use ninefold.example. Replace the domain and the report address with your own, and publish each one under the host `_dmarc`. ### Monitoring `v=DMARC1; p=none; rua=mailto:dmarc@ninefold.example` ### Quarantine `v=DMARC1; p=quarantine; rua=mailto:dmarc@ninefold.example` ### Reject `v=DMARC1; p=reject; np=reject; rua=mailto:dmarc@ninefold.example` > Older guides, including Google’s rollout page, use `pct=` to enforce on a percentage of mail [S3]. RFC 9989 removed the tag because receivers applied it reliably only at 0 or 100, and added `t=y` for a testing period instead [S1]. Receivers must ignore tags they do not know, so one that does not support `np` or `t` yet simply skips them [S1]. ## What the rua reports tell you Mailbox providers that send aggregate reports usually send one a day per domain, as a compressed XML file [S2]. Each report lists the IP addresses that sent mail using your domain, how many messages came from each, the SPF and DKIM results, whether they aligned, and what the receiver did with the mail [S2]. - **A source you recognize that fails alignment** is a sender you forgot to set up. Turn on DKIM for your domain in that service, or add it to SPF. - **A source you do not recognize** is either a service someone on your team signed up for, or someone spoofing your domain. Ask around before you enforce. - **Forwarded mail** often fails SPF and passes DKIM [S1]. That is expected, and one reason aligned DKIM matters most. Raw XML is hard to read by hand, so many shops send `rua` to a report service that turns it into charts. If that service uses another domain, it must publish an authorization record, or receivers ignore the address [S2]. Report services set this up on their side. ## Moving from p=none to quarantine to reject The order is always the same: monitor, then quarantine, then reject. What varies is how long each stage lasts. Google suggests at least a week at none [S3]. RFC 9989 suggests at least a month at none and a similar period at quarantine before reject [S1]. A shop with a handful of senders and clean reports can move faster than one with a dozen tools. | Policy | Failing mail | When to use it | | --- | --- | --- | | p=none | Delivered as usual; reports only | While you find every sender | | p=quarantine | Treated as suspicious, usually sent to spam | Once reports show all your senders aligned | | p=reject | Refused by the receiver | After a clean period at quarantine | Before each change, check the last week of reports for failing sources you recognize. If staff post to mailing lists from the shop domain, RFC 9989 advises against `p=reject`: list mail rejected by receivers causes problems for the list and can get subscribers removed [S1]. Quarantine is a reasonable place to stop in that case. ## DMARC for subdomains Without its own record, a subdomain such as news.ninefold.example uses the policy on ninefold.example. Use `sp` to give existing subdomains a different policy, and `np` for names that do not exist, which are a common way to spoof a brand [S1]. Some shops send marketing email from a subdomain to keep it separate from staff mail. That subdomain can have its own `_dmarc` record. RFC 9989 describes testing a subdomain with `p=quarantine; t=y`, then switching to `p=reject` and removing the testing flag [S1]. ## Setting up DMARC with Tellnod in Claude or ChatGPT Tellnod is an [MCP connector](https://tellnod.com/glossary#mcp-connector) for writing, previewing and sending marketing email from Claude or ChatGPT. You can send right away from an address on Tellnod’s shared domain, such as hello@yourshop.tellnodmail.com, within limits of 500 recipients per campaign and 1,000 emails a month. Verifying your own domain lifts those limits. Ask in the chat: “Set up ninefold.example as my sending domain.” Tellnod gives you the SPF, DKIM and DMARC records and checks them for you. If someone else manages your DNS, ask for a setup link to send them: they can add the records in one click on supported providers, or copy them, without creating an account. You are notified in the chat and by email when the domain is verified. If you already have a DMARC record, keep one record only and make sure your Tellnod mail aligns before you tighten the policy. Every campaign still goes through a desktop and mobile preview and a confirmation card that only you can press. [Connect Tellnod](https://tellnod.com/connect) to start on the free plan, or compare plans on the [pricing page](https://tellnod.com/pricing). For the rest of what Gmail and Yahoo expect, see the [deliverability basics](https://tellnod.com/guides/email-deliverability-basics). ## FAQ ### What is a good DMARC record to start with? Start with v=DMARC1; p=none; rua=mailto: followed by an address you read. It changes nothing about delivery and starts the daily reports [S1]. ### Is p=none enough for Gmail and Yahoo? Yes, for the bulk sender requirements. Both accept a policy of none, as long as the From domain aligns with SPF or DKIM [S4][S5]. Enforcing later adds protection against spoofing. ### How long should I stay at p=none? Until the reports show every legitimate sender aligned. Google suggests at least a week, and RFC 9989 suggests about a month before enforcement [S1][S3]. ### Can I have two DMARC records? No. Publish one TXT record at _dmarc. If a lookup returns more than one DMARC record, receivers discard all of them, so merge them into one [S1]. ### Does the DMARC record go on the root domain or a subdomain? On the host _dmarc of the domain in your From address. A record on the main domain also covers subdomains that have no record of their own, through its p, sp or np tag [S1]. ## Sources - [S1] RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC): (checked 2026-10-22) - [S2] RFC 9990: DMARC aggregate reporting: (checked 2026-10-22) - [S3] Google Workspace Admin Help: Recommended DMARC rollout: (checked 2026-10-22) - [S4] Google Workspace Admin Help: Email sender guidelines: (checked 2026-10-22) - [S5] Yahoo Sender Hub: Sender best practices: (checked 2026-10-22)