DMARC – how to protect your sender domain and reach the inbox

Gmail, Yahoo and Microsoft now require senders of newsletters and other sends to have DMARC in place. Without it, your emails risk ending up in spam, or not being delivered at all. This guide explains what DMARC is, how it relates to SPF and DKIM, and how to set it up step by step.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a technical standard that tells receiving mail servers how to handle email that claims to come from your domain but cannot prove it. DMARC builds on SPF and DKIM and protects your domain against forged senders.

Why do you need DMARC?

Two reasons: deliverability and protection.

Since 2024, Google and Yahoo have required those who send larger volumes of email to have SPF, DKIM and DMARC configured. Microsoft has introduced corresponding requirements for Outlook and Hotmail. Without DMARC, your sends are treated with more suspicion, which in practice means worse deliverability.

The protection is about your sender domain. Without DMARC, anyone can send email that looks like it comes from your organization. This is exploited in phishing and fraud, and it damages trust in everything you send.

How SPF, DKIM and DMARC fit together

The three standards do different jobs:

• SPF lists which servers are allowed to send email for your domain.
• DKIM signs every email cryptographically so that the recipient can verify that the content has not been changed.
• DMARC ties them together: it says what the recipient should do when SPF or DKIM does not match, and gives you reports on who sends in your name.

DMARC requires SPF and DKIM to be in place already. If you do not have that in place, start with our guide on SPF and DKIM.

The three policy levels of a DMARC record

The core of DMARC is the policy, which tells the recipient how strictly to act:

• p=none – monitor only. Nothing is stopped, but you get reports. This is where everyone starts.
• p=quarantine – emails that fail the check are put in spam.
• p=reject – emails that fail the check are rejected entirely. The strongest protection.

Set up DMARC step by step

1. Check SPF and DKIM. Both must be configured correctly for your sender domain, including for the service you send newsletters through.
2. Create a DMARC record in your DNS. It is a TXT record on the name _dmarc.yourdomain.com.
3. Start with p=none and reporting. Example:
   v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
4. Read the reports for a few weeks. They show which servers send in your domain's name. Check that all legitimate sources (email platform, finance system, CRM) pass the check.
5. Tighten the policy. When the reports look clean, switch to p=quarantine and then p=reject.

Common mistakes

• Going straight to p=reject. Then you risk blocking legitimate sends from systems you have forgotten about. Monitor first.
• Forgetting subdomains. DMARC is inherited downwards unless you specify otherwise. If you send from a subdomain, check that it also passes SPF and DKIM.
• Never reading the reports. The reports are the whole point of DMARC. There are free tools that compile them in a readable way.
• Mixing up the sender address and the sender domain. DMARC checks the domain in your visible sender address. If you send newsletters through a service, the service must be able to sign with your domain.

DMARC when you send newsletters through Paloma

If you send newsletters through Paloma, we help you get SPF and DKIM right for your sender domain, so that your DMARC policy can be tightened without your sends being affected. Get in touch with support if you are unsure where you stand today.

Frequently asked questions about DMARC

Is DMARC mandatory?

Formally no, but in practice yes if you send newsletters or other sends in volume. Gmail, Yahoo and Microsoft require DMARC from larger senders, and without it deliverability gets worse for smaller senders too.

What does DMARC cost?

The DNS record itself is free. Tools that compile the reports are available both for free and as paid services.

How long does it take to get to p=reject?

Expect a few weeks to a couple of months. The time goes into monitoring the reports and fixing the sources that fail the check.

Does DMARC affect my ordinary emails from Outlook or Gmail?

Yes, the policy applies to all email from the domain. That is why it is important that your ordinary mail server also passes SPF and DKIM before you tighten the policy.

Get started with secure sends

With DMARC in place, your sender domain stands firm. The next step is the content. Create a free account and send your first newsletter in a few minutes.