Email security: DMARC enforcement step by step

DMARC stops others from sending email that pretends to come from your domain. Reaching enforcement takes a careful sequence.

1. Publish a monitoring policy

Start with p=none and a reporting address to receive aggregate reports.

2. Find every legitimate sender

Reports show which services send as your domain: your mail service, website forms, newsletters, invoicing tools.

3. Authenticate them

Configure SPF and DKIM for each legitimate sender.

4. Move to quarantine

When reports show legitimate mail passing, set p=quarantine, optionally for a percentage of mail first.

5. Move to reject

When confident, set p=reject.

6. Keep watching

New services added later must be authenticated before they send.

See our email security services.