How to fix your DMARC record

If you have no DMARC record

Publish a monitoring policy at _dmarc.yourdomain. A monitoring policy asks receivers to report what they see and to act on nothing, so it cannot affect delivery. Include a rua address that you actually read — without it you are configuring DMARC blind, and you will never be able to raise it safely.

Aggregate reports arrive as daily XML attachments. They are not pleasant to read by hand, but they are the only systematic way to discover the systems sending mail as your domain, including the ones nobody remembers setting up.

If you have more than one DMARC record

RFC 9989 requires receivers to discard all of them when more than one is returned. Publishing two therefore leaves you with no DMARC policy at all, while a control panel shows two perfectly valid records. Keep one, delete the rest.

Moving from monitoring to enforcement

The order that works: publish p=none with reporting, read reports for at least two weeks, fix every legitimate sender that is not aligning, then move to p=quarantine, then, when reports are clean, to p=reject.

Skipping to p=reject because it scores higher is the single most damaging thing a well-meaning administrator can do to a domain's mail. The systems that break are the ones nobody remembered: the invoicing platform, the booking system, the newsletter tool set up by someone who left.

Subdomains

sp sets the policy for subdomains, and np, added by RFC 9989, sets it for subdomains that do not exist in DNS at all. Forged subdomains are common precisely because sp is so often left permissive.