How do I configure DMARC without breaking legitimate sends?

To configure DMARC safely, the key is to roll it out gradually and make sure SPF and DKIM are already aligned for all legitimate mail streams before you start rejecting mail.

Safe DMARC rollout plan

1) Inventory all legitimate senders

List every service that sends mail for your domain, for example:

• Google/Microsoft mail
• CRM tools
• Marketing platforms
• Ticketing/support systems
• Monitoring/alerting systems
• Internal apps and servers

For each sender, identify:

• Which domain is used in the visible From: address
• Whether it supports SPF
• Whether it supports DKIM
• Whether its signatures/return-path can align with your From domain

2) Make SPF and DKIM pass for legitimate mail

DMARC passes when either SPF or DKIM passes and aligns with the From domain.

SPF

• Ensure each sending service is included in your SPF record, either directly or via an include: mechanism.
• Keep within the DNS lookup limit of 10.
• Prefer using the service’s recommended SPF entry.

DKIM

• Enable DKIM for all systems you control and for third-party platforms that support it.
• Use a selector per service if possible.
• DKIM is often more reliable than SPF for forwarding scenarios.

3) Start with a monitoring policy

Publish DMARC in monitor-only mode first:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r

Recommended initial settings:

• p=none — do not block anything yet
• rua= — receive aggregate reports
• adkim=r, aspf=r — relaxed alignment is usually safer at first

If you want forensic reports, be cautious with ruf= because many providers limit them and they may contain sensitive data.

4) Review DMARC reports before enforcing

Look for:

• Sources that fail DMARC
• Legitimate services not yet aligned
• Unexpected sending IPs or domains
• Mail streams with SPF pass but alignment fail
• Mail streams with DKIM pass but alignment fail

Fix issues by:

• Adding/adjusting SPF includes
• Enabling DKIM on the service
• Updating the From domain used by the service
• Configuring a custom sending subdomain if the provider supports it

5) Move to quarantine gradually

When legitimate mail is stable, enforce a soft policy:

v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@yourdomain.com

Tips:

• Start with pct=10 or pct=25
• Increase gradually to 50, 75, then 100
• Watch reports carefully after each increase

6) Move to reject only when confident

Once all known mail streams authenticate and align correctly:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; fo=1

You can keep pct=100 once you’re confident.

Common ways DMARC breaks legitimate mail

• A third-party service sends with your domain in From, but you never enabled its DKIM
• SPF includes the service, but the envelope-from domain doesn’t align
• Forwarding systems break SPF
• Internal apps send from your domain but aren’t authenticated
• Multiple email platforms are used, but only one is configured for DMARC alignment
• Subdomains are forgotten

Use subdomains for separate senders

If different systems send mail, consider using subdomains like:

• alerts.yourdomain.com
• mail.yourdomain.com
• news.yourdomain.com

Then publish separate DMARC/SPF/DKIM policies per subdomain.

Example:

_dmarc.yourdomain.com      TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
_dmarc.alerts.yourdomain.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com"

Practical recommendations

• Don’t go straight to p=reject
• Make sure DKIM is enabled everywhere possible
• Use custom domains/subdomains for third-party senders
• Keep DMARC reports flowing and review them regularly
• Treat forwarding/mail list behavior as expected edge cases

If you want, I can help you build a DMARC rollout plan for your specific setup (Google Workspace, Microsoft 365, Mailchimp, etc.) or review your current SPF/DKIM/DMARC records.