DMARC tells receiving servers what to do when SPF or DKIM fails, and sends you reports.
WHAT TO ADD
A TXT record named _dmarc at your domain, with a value such as:
v=DMARC1; p=none; rua=mailto:[email protected]WHAT THE PARTS MEAN
p=none means monitor only, taking no action on failures rua is where aggregate reports are sent Later you can move to p=quarantine, which sends failures to spam, then p=reject, which refuses them
THE RIGHT SEQUENCE
- Publish with p=none and collect reports for a few weeks.
- Read the reports to find every system sending as your domain, including ones you forgot about.
- Make sure all of them pass SPF or DKIM.
- Move to p=quarantine, and watch.
- Move to p=reject once you are confident.
WHY NOT GO STRAIGHT TO REJECT
Because you will discover, by its absence, some system that sends legitimate mail as your domain. Invoicing software and newsletter platforms are typical. Monitoring first prevents that.
