SAGERANK
SAGERANK AI Search Visibility & Security
language العربية Contact Sign Up Free bolt

Domain security

How do I set up DMARC without breaking my email?

Reviewed 2 November 2026 by the SageRank team

Short answer

List every service that sends email as your domain, make sure each passes SPF or DKIM with alignment, publish a DMARC record with p=none and a reporting address, read the reports for a few weeks, fix what fails, then move to quarantine and finally reject in stages.

The steps

  1. Inventory your senders. Your mailboxes, website forms, newsletters, CRM, invoicing and support tools.
  2. Set up SPF and DKIM for each one. See SPF and DKIM.
  3. Publish a monitoring record. v=DMARC1; p=none; rua=mailto:dmarc@yourdomain
  4. Read the reports for two to four weeks. Use a free report reader if the raw files are hard to read. Find senders you forgot and fix them.
  5. Move to p=quarantine, starting with pct=10 and raising it as the reports stay clean.
  6. Move to p=reject once legitimate mail passes consistently.
  7. Set sp= for subdomains, and publish a reject policy on domains you do not send from.

Pitfalls

  • Jumping to reject on day one can bounce real mail from a sender you forgot.
  • Forwarding and mailing lists can break SPF. DKIM usually survives them.
  • A new tool you add later needs SPF or DKIM too. Review DMARC reports after any change.

How SageRank helps

The free report does not test domain security. SageRank’s Sentinel and Ultimate plans run ten levels of domain security checks through ShieldAI. See ShieldAI.

Related answers