Publish, monitor and enforce safely
-
1
Inventory every legitimate sender
List every service that sends with your domain in the visible From address, including hosted mail, website forms, invoices, marketing, support desks, gateways and reseller platforms. A forgotten sender can fail after enforcement begins.
-
2
Complete SPF and DKIM first
Send external test messages from every service. DMARC passes when at least one authenticated SPF or DKIM domain aligns with the visible From domain. Correct missing or unaligned authentication before enforcing a DMARC policy.
-
3
Create a reporting mailbox
Create the aggregate-report mailbox shown in the record, use a monitored group or choose a trusted DMARC reporting service. Reports help identify legitimate and unauthorized sending sources.
-
4
Publish the monitoring record
At the authoritative DNS provider create one TXT record at _dmarc for the sender domain. Start with p=none so reports can be reviewed without asking receivers to quarantine or reject failing mail.
-
5
Test the published record
Wait for DNS propagation, confirm exactly one DMARC record is returned, then send new messages from every legitimate system. Check Authentication-Results and the aggregate reports for aligned SPF, DKIM and DMARC results.
-
6
Fix failures before enforcement
Correct every legitimate source that fails alignment. Remove obsolete services and investigate unknown sources. Keep the monitoring policy until normal mail streams consistently pass.
-
7
Increase the policy in stages
Replace the monitoring record with p=quarantine only after reviewing reports. Move to p=reject only when legitimate mail continues to pass. Publish one policy record at a time; do not add all three examples.
-
8
Recheck VerifySeal
Run the email DNS check from the customer order or seal. Keep monitoring reports and repeat the check after changing senders, DNS providers or mail services.