How do I set up DMARC after SPF and DKIM are passing?

#43 Resolved

Benjamin H. 306 days ago

Got SPF and DKIM both passing now. Docs I've read say DMARC is the next step but I'm nervous about setting it wrong and blocking my own mail. What's the safe way to add it?

Laura Garcia Staff 306 days ago

Smart to be cautious — the safe approach is to start in monitoring-only mode. Add a TXT record at _dmarc.yourdomain.com with:

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

With p=none, nothing gets blocked or quarantined — you just start receiving daily aggregate reports showing what's passing/failing across all mail claiming to be from your domain. After a couple weeks of clean reports with no unexpected failures, you can tighten it to p=quarantine, and eventually p=reject once you're fully confident.

Benjamin H. 305 days ago

That makes sense. Once I move to p=reject eventually, does that only affect emails sent through SubsiMail, or all email from my domain generally, including like a personal Gmail alias?

Laura Garcia Staff 305 days ago

All email claiming to be from your domain, regardless of what sent it — DMARC is domain-wide, not tool-specific. So if you also send from a personal alias, an invoicing tool, a helpdesk system, etc., all of those need to be passing SPF or DKIM (with alignment) too, or they'll get rejected once you're at p=reject. That's exactly why the monitoring period matters — the aggregate reports will show you every source sending as your domain, including ones you might have forgotten about.

This ticket has been resolved. Its author or SubsiMail staff can reopen it to reply further.