What DMARC policy should I start with?

Start with "none" (p=none) to monitor your email traffic without affecting delivery. This lets you receive reports and identify all legitimate email sources. Once you've confirmed all your email is properly authenticated, move to "quarantine" and eventually "reject" for maximum protection.

How does DMARC work with subdomains?

By default, your DMARC policy applies to all subdomains. You can set a different policy for subdomains using the "sp" tag. For example, you might use "reject" for your main domain but "none" for subdomains if you have third-party services sending from them.

Can I use DMARC without SPF or DKIM?

Technically yes, but it's not recommended. DMARC works by checking if emails pass SPF and/or DKIM authentication. Without at least one of these in place, DMARC has nothing to verify against, making it ineffective. For best results, set up SPF, DKIM, and DMARC together.

consulti.ai

Free ToolInstant · No signup

DMARC Record Generator.

Create a DMARC record to protect your domain from spoofing and phishing. Free DMARC generator with policy configuration and aggregate reporting.

Generate DMARC Policy

Configure your policy and reporting addresses — we'll build a valid DMARC record.

Domain Name *

DMARC Policy *

None (Monitoring Only)

Receive reports but take no action on failing emails. Recommended when starting.

Quarantine

Send failing emails to spam/junk folder. Good intermediate step.

Reject

Block emails that fail DMARC. Most secure, use after monitoring.

Aggregate Report Email (Optional)

Receive daily reports about emails sent from your domain. Highly recommended.

Subdomain Policy (Optional)

Apply a different policy to emails from subdomains (e.g., mail.example.com)

Policy Percentage: 100%

0% (No enforcement)100% (Full enforcement)

Gradually increase from 0% to 100% when moving from “none” to “quarantine” or “reject”.

Recommendation: Start with “none” policy to monitor your email flow, then gradually move to “quarantine” and finally “reject” once you're confident your legitimate emails are properly authenticated.

Frequently Asked Questions

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record that tells email receivers what to do when emails fail SPF or DKIM authentication. It also enables you to receive reports about emails sent using your domain, helping you identify legitimate senders and potential abuse.

Complete Your Email Authentication

DMARC requires SPF and/or DKIM to be effective. Make sure all three are configured.

SPF Generator

Authorize your email servers

DKIM Generator

Generate DKIM keys for signing

Domain Health Scanner

Verify your DNS records

Why DMARC is Essential for Email Security

DMARC is the final piece of email authentication that brings SPF and DKIM together. It tells receiving mail servers exactly what to do when an email fails authentication: deliver it anyway, send it to spam, or reject it entirely.

More importantly, DMARC enables you to receive aggregate reports about all emails sent using your domain. These reports help you discover unauthorized use of your domain and ensure legitimate email services are properly configured.

The DMARC Rollout Strategy

We recommend a gradual rollout: Start with p=none to collect data without affecting email delivery. Review your DMARC reports to identify all legitimate senders and fix any authentication issues. Then move to p=quarantine to send failing emails to spam. Finally, once you're confident, switch to p=reject for maximum protection against spoofing.

The playbook

Three rules. Memorize them.

SPF, then DKIM, then DMARC.

In that order. Each builds on the last. Skip DKIM and Outlook quietly junks half your mail.

3/3required

Use DMARC quarantine, not none.

DMARC=none does nothing. Set p=quarantine + rua report email. Catch spoofing in 24h.

p=qpolicy

Re-check after every DNS change.

DNS propagates inconsistently. Verify all records hit before you trust the new config.

< 1hpropagation

What's next

DNS is step one. Here's where to go next.

Domain Health Check

Free

Verify your records are live and your domain is off blacklists. Run after every DNS change.

Check domain

Inbox Placement Test

Free

New DNS records live? Confirm they actually move you out of spam with a 30-seed inbox test.

Run placement test

AI Copy King

Pro

Foundation is set. Now scale: AI writes full sequences with personalized openers.

Write my sequence

50% off Pro Plan

The whole stack the top 1% use. Half off.

Stop duct-taping verifiers, scrapers and copy tools. Run the entire pipeline from one place.

Export 10K Verified Leads

Hypercleaner Access

Full Auto-Pilot Campaigns

Unlimited Tool Usage

14-day money-backCancel anytimeNo credit card today

What you save

$48.50/mo

$97/mo

You save $48.50 this month

Half off applies to your first month

“We only run this discount once a year. The exact stack the top 1% use.”

— Lead Gen Jay, founder