How to Set Up DMARC: Step-by-Step Guide (Microsoft 365 & Google)

Last updated: October 2026

Disclosure: This guide contains no paid placements. The founder of WavesRank works at an IT company that resells EasyDMARC, one of the monitoring tools mentioned below. See our Affiliate Disclosure and Editorial Policy.

If criminals can send email that looks like it comes from your domain, they can trick your customers, suppliers and staff into paying fake invoices or handing over passwords. DMARC is the DNS record that tells Gmail, Outlook and other mail providers what to do with email that pretends to be from you. It also gives you reports showing who is sending email in your name.

DMARC is no longer optional for many businesses. Google and Yahoo have required it for bulk senders since 2024, and Microsoft began enforcing similar rules for Outlook.com in May 2025. Even if you send less than that, a correct DMARC setup helps your real emails reach the inbox instead of spam.

This guide walks you through setting up DMARC step by step, including the exact settings for Microsoft 365 and Google Workspace.

DMARC setup in 6 steps (summary)

List every service that sends email using your domain.
Set up SPF: one TXT record listing those services.
Turn on DKIM in Microsoft 365, Google Workspace and your other email tools.
Publish a DMARC record with p=none to start monitoring.
Read the reports for 2–4 weeks and fix anything legitimate that fails.
Move to p=quarantine, then p=reject to block spoofed email.

Plan on 4–8 weeks from start to full protection. The DNS changes take minutes; most of the time is spent watching reports to be sure you will not block your own email.

What you need before you start

Access to your DNS settings. This is wherever your domain’s DNS is managed: your domain registrar, hosting company (for example Hostinger or GoDaddy) or Cloudflare.
Admin access to your email platform, such as Microsoft 365 or Google Workspace.
A mailbox for reports, for example dmarc-reports@yourdomain.com, or an address from a DMARC monitoring service.

How SPF, DKIM and DMARC work together

SPF lists the servers allowed to send email for your domain.
DKIM adds a digital signature to each email so the receiver can check it was not changed and really came from your domain.
DMARC checks that SPF or DKIM passes and matches the domain in the visible “From” address (this is called alignment). It then tells the receiver what to do if the check fails, and sends you reports.

DMARC only works properly when SPF and DKIM are set up first.

Step 1: List every service that sends email as your domain

This is the step most businesses skip, and the reason DMARC rollouts go wrong. Make a list of everything that sends email with your domain in the From address, for example:

Your main mailboxes (Microsoft 365 or Google Workspace)
Newsletter and marketing tools (Mailchimp, Brevo, HubSpot)
Invoicing and accounting software (QuickBooks, Xero, Zoho)
Your website contact forms and online shop
Helpdesk, CRM or booking systems
Scanners, printers or line-of-business apps that send email

Each of these must pass SPF or DKIM before you can safely block failing email.

Step 2: Set up SPF

SPF is a single TXT record at the root of your domain. You must have only one SPF record. If you have two, SPF fails.

Microsoft 365 only:

v=spf1 include:spf.protection.outlook.com -all

Google Workspace only:

v=spf1 include:_spf.google.com -all

Microsoft 365 plus a marketing tool (example):

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

Each sending service publishes its own “include” value in its help pages. Add them all into the same record.

Two things to watch:

The 10-lookup limit. SPF allows at most 10 DNS lookups. Every include counts, and some count more than once. Too many services can break SPF, which is another reason DKIM matters.
-all versus ~all. -all (fail) is stricter than ~all (soft fail). Once DMARC is enforced, either works, because DMARC decides the outcome.

Step 3: Turn on DKIM

DKIM in Microsoft 365

Sign in to the Microsoft Defender portal (security.microsoft.com) as an admin.
Go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Microsoft moves these menus from time to time; searching for “DKIM” in the portal also works.
Select your domain. Microsoft shows two CNAME records, named selector1._domainkey and selector2._domainkey.
Add both CNAME records in your DNS exactly as shown. The values are unique to your tenant, so copy them rather than typing them.
Wait for DNS to update (usually minutes, sometimes a few hours), then return to the portal and switch Sign messages for this domain with DKIM signatures to Enabled.

DKIM in Google Workspace

Open the Google Admin console.
Go to Apps → Google Workspace → Gmail → Authenticate email.
Select your domain and click Generate new record (choose a 2048-bit key if your DNS provider supports it).
Add the TXT record Google shows (usually named google._domainkey) to your DNS.
Back in the Admin console, click Start authentication.

DKIM for your other tools

Marketing, CRM and invoicing tools almost always offer “domain authentication” in their settings. Follow their steps to add their DKIM records, so their email is signed with your domain rather than theirs. This is what makes them pass DMARC.

Step 4: Publish your DMARC record

Create a TXT record with the host name _dmarc (so the full name is _dmarc.yourdomain.com). Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

With p=none, nothing is blocked. Receivers simply send you daily aggregate reports showing every server sending email as your domain and whether it passed.

DMARC tags you should know

Tag	What it does	Example
`v`	Version, always first	`v=DMARC1`
`p`	Policy for your domain: none, quarantine or reject	`p=none`
`rua`	Where aggregate reports are sent	`rua=mailto:dmarc@yourdomain.com`
`sp`	Policy for subdomains (defaults to `p`)	`sp=reject`
`np`	Policy for subdomains that do not exist	`np=reject`
`adkim` / `aspf`	Alignment mode: relaxed (`r`, default) or strict (`s`)	`adkim=r`
`t`	Test mode: applies the next, gentler policy while you test	`t=y`

Note on the 2026 update: DMARC was updated in May 2026 (RFC 9989–9991). The old pct tag is replaced by t, and the rf and ri tags are no longer used. Existing records keep working, so you do not need to rush, but new records should follow the updated tags.

Step 5: Read your reports and fix failures

DMARC aggregate reports are XML files, which are hard to read by hand. A DMARC monitoring service turns them into a simple dashboard. Options include:

Free: Cloudflare’s DMARC Management (if your DNS is on Cloudflare) and Postmark’s free weekly DMARC digests.
Paid platforms with more features: EasyDMARC, dmarcian and Valimail, among others.

For 2–4 weeks, look for:

Legitimate services failing. Fix them by adding them to SPF or turning on their DKIM signing.
Unknown servers sending as you. If you do not recognise them, they may be spoofing attempts, which is exactly what DMARC will block.

When almost all of your real email passes, move to the next step.

Step 6: Move to quarantine, then reject

Quarantine: change your record to p=quarantine. Failing email goes to spam. If you want to be cautious, add t=y for the first week.
```
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com
```
Keep watching reports for 1–2 weeks.

Reject: change to p=reject. Spoofed email is now refused completely.

v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc-reports@yourdomain.com

Only p=quarantine or p=reject actually protects your domain. Many businesses stop at p=none and stay exposed.

How to check your DMARC record

Use a free online checker such as MXToolbox’s DMARC lookup.
Or run this command on Windows (Command Prompt):
```
nslookup -type=txt _dmarc.yourdomain.com
```
On Mac or Linux:
```
dig txt _dmarc.yourdomain.com
```

You should see exactly one record starting with v=DMARC1.

Common DMARC mistakes

Two SPF records instead of one combined record.
Jumping straight to p=reject and blocking your own invoices or newsletters.
Forgetting third-party senders, such as accounting software or website forms.
Never moving past p=none, so the domain stays unprotected.
Ignoring parked domains. Domains you own but do not send email from should have v=spf1 -all and v=DMARC1; p=reject; so they cannot be spoofed.

Frequently asked questions

Do I need DMARC if I’m a small business? Yes. Small businesses are frequent targets of invoice fraud and impersonation, and DMARC also improves delivery of your real email to Gmail and Outlook.

Will DMARC stop all phishing? No. It stops criminals sending email that uses your exact domain. It does not stop look-alike domains (for example yourdomain-invoices.com), so staff training and other email security still matter.

How long does DMARC take to set up? The DNS records take minutes. Moving safely from monitoring to p=reject usually takes 4–8 weeks.

Does Microsoft 365 set up DMARC for me? No. Microsoft 365 shows you the SPF and DKIM values to use, but you must publish your own SPF, DKIM and DMARC records in your DNS for your custom domain.

Next steps

DMARC protects email that uses your domain. To protect the accounts behind it, make sure every staff member uses strong, unique passwords. Our comparison of the best password managers for small business shows the options from about $2 per user per month.

Related guides

DMARC standards and provider settings change over time. This guide reflects the requirements and portal menus as of October 2026.

How to Set Up DMARC (Step by Step for Small Businesses)