How to Set Up DMARC in 2026: Step-by-Step Guide with Records

What DMARC is and why you need it in 2026

Setting up DMARC means adding one TXT record at _dmarc.yourdomain that tells mailbox providers what to do with messages that fail SPF and DKIM. Since February 2024 Gmail and Yahoo require DMARC for senders above 5,000 messages a day, and by 2026 it is the de-facto minimum for any campaign. Here is a step-by-step plan with real record examples.

Prerequisites: SPF and DKIM

DMARC builds on SPF and DKIM, so configure those first. An SPF record allowing YourTrend and Google Workspace:

example.com.  IN TXT  "v=spf1 include:_spf.yourtrend.online include:_spf.google.com -all"

A DKIM record looks like this (selector yt1 is issued in the YourTrend panel):

yt1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ..."

The key DMARC concept is alignment. The domain in the From: header must match the domain that passed SPF (via Return-Path) or DKIM (via the d= signature). One match is enough. Without alignment DMARC fails even if SPF and DKIM are technically valid.

Your first DMARC record: p=none

Always start in monitoring mode. It blocks nothing but turns on reporting:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1; adkim=r; aspf=r; pct=100"

The tags explained:

How to read aggregate (rua) reports

Once a day providers send a compressed XML to your rua address. Inside is a summary per source: sender IP, message count, and whether SPF/DKIM and alignment passed. A fragment:

<record>
  <row>
    <source_ip>37.59.138.174</source_ip>
    <count>248</count>
    <policy_evaluated><dkim>pass</dkim><spf>pass</spf></policy_evaluated>
  </row>
</record>

Raw XML is hard to read. Upload the reports to an analyzer — for example the free YourTrend deliverability lab, which parses rua and shows which sources send as you and where authentication breaks.

Phased policy rollout

Do not jump straight to reject — first confirm from the reports that every legitimate source (CRM, campaigns, transactional, support) passes DMARC.

1. Weeks 1–2: p=none. Collect reports, discover all sources.
2. Weeks 3–4: p=quarantine; pct=25 — 25% of failing mail to spam.
3. Weeks 5–6: p=quarantine; pct=100.
4. Week 7+: p=reject — failing mail rejected outright.

The final enforced record:

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s; pct=100"

Common mistakes

• Multiple DMARC records on one domain — only one is valid.
• Forgetting subdomains: the sp= tag sets the subdomain policy separately.
• The rua mailbox overflows — use a dedicated address or an external service.
• Moving to reject without reading reports — legitimate mail starts disappearing.

Forensic (ruf) reports: enable with care

Unlike aggregate rua, forensic (ruf) reports are sent per failing message and contain fragments of it — the subject, headers, sometimes part of the body. For privacy and GDPR reasons most large providers (Gmail, Microsoft) do not send them at all, and those that do often redact personal data. Enable ruf only while investigating an incident, and give it a dedicated mailbox — volume can be high. The fo=1 tag means "send a report if either SPF or DKIM fails".

DMARC for subdomains

The sp= tag sets the policy for all subdomains separately from the root domain. It closes spoofing on non-existent subdomains like news.example.com:

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

If a particular subdomain sends through a separate service with its own authentication, publish a dedicated _dmarc.news.example.com record with a softer policy.

Mini-FAQ

Does DMARC break forwarding?

Forwarding often breaks SPF, but DKIM usually survives, and the ARC standard helps providers trust the forwarding chain. With a valid DKIM signature, legitimate forwarding passes DMARC.

How soon do reports arrive?

The first rua reports come within 24–72 hours of publishing a record with the rua tag. A full picture of all sources builds over 1–2 weeks.

Does a small business need DMARC?

Yes. Even if you send no campaigns, DMARC protects your domain from being spoofed for phishing — a reputational and financial risk.

After DMARC, the logical next step is BIMI to show your brand logo in the inbox — see our BIMI guide. And sending with SPF/DKIM/DMARC already in place is easy through YourTrend SMTP and API.