DMARC Setup for a Sending Domain: SPF, DKIM and DMARC Step by Step, from p=none to Reject

What do SPF, DKIM and DMARC each do?

• SPF publishes which servers may send mail for a domain. It is one TXT record beginning v=spf1 (RFC 7208, sections 3 and 4.5). It checks the envelope sender (MAIL FROM) and also the HELO identity.
• DKIM signs each message. The signature names a signing domain (d=) and a selector (s=), and the receiver fetches the public key from a TXT record at selector._domainkey.domain (RFC 6376, sections 3.5 and 3.6).
• DMARC asks whether SPF or DKIM passed and whether the domain that passed matches the domain in the visible From address. That match is called alignment. If neither aligns, DMARC fails, even when SPF or DKIM passed for some other domain. Google's guidelines say the same: a DMARC pass needs SPF or DKIM to pass and the authenticating domain to match the From domain.

How do you set up SPF?

1. Practice: list every service that sends mail as your domain: your mailbox provider, your cold email or newsletter tool, your CRM, your invoicing tool, your website forms.
2. Publish exactly one SPF TXT record at the domain. Rule: RFC 7208 says a domain must not have multiple records that would cause more than one to be selected, and the result is a permanent error if more than one remains.
3. Add one include for each sender, using the value each provider gives you. Example with placeholder values: v=spf1 include:spf.mailhost.example include:spf.tool.example ~all.
4. Count the lookups. Rule: include, a, mx, ptr, exists and redirect each count toward a limit of 10 DNS lookups. Going over 10 produces a permanent error, so SPF cannot pass. ip4, ip6 and all do not count.

The qualifier on all is your choice: -all means fail and ~all means softfail (RFC 7208, section 4.6.2). Keep the record to one line and re-check the lookup count each time you add a tool.

How do you set up DKIM?

1. Turn on DKIM signing in each sending service. The service generates the key pair and gives you a record to publish.
2. Publish the TXT record at the host the service names, which has the form selector._domainkey.yourdomain. Its value begins v=DKIM1; k=rsa; p= followed by the public key. An empty p= means the key is revoked.
3. Choose 2048-bit keys where the provider offers them. Rule: RFC 6376 requires signers to use RSA keys of at least 1024 bits for long-lived keys, and Google's sender guidelines require at least 1024 and recommend 2048.
4. Send a test message to a mailbox you control and look at the full message headers. Practice: the receiving server records whether SPF, DKIM and DMARC passed, and the signing domain should match your From domain.

How do you publish a DMARC record?

Rule. A DMARC record is a TXT record at _dmarc prepended to the domain (RFC 9989, sections 4.1 and 4.5). Start with the monitoring policy, as Google's setup guide advises:

Host: _dmarc.example.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Two practical details. First, the reporting mailbox: Google advises a dedicated group or mailbox, or a third-party reporting service, because the volume can be high, and says that if the report address is on a different domain you must add a DNS record at that domain authorizing it. RFC 9989 section 11.6 gives the same rule and points to RFC 9990 for the mechanism. Second, one record per domain: publish a record for each domain you send from, including any separate sending domain.

If you read older guides, you will see a pct tag that applied the policy to a percentage of mail. Rule: RFC 9989 lists pct as historic and replaces it with the t tag, because pct was usually not applied accurately outside 0 and 100. Google's setup page still describes pct, so both forms are in circulation. Use whichever your DNS and report tools handle, and expect receivers to differ.

How long should you stay at p=none before moving to quarantine and reject?

Rule. RFC 9989 section 7.4 recommends that a domain heading for reject first publish p=none for at least a month, then p=quarantine for an equally long period, comparing the results with the aggregate reports at each step. The meanings come from the same RFC: none states no preference, quarantine says mail that fails should be considered suspicious, and reject says failures are a clear sign the domain is not validly used. What a receiver does with a failure is still the receiver's decision.

Reject is not always right. Rule: RFC 9989 section 7.4 says p=reject can cause problems for alumni forwarders, role-based aliases and mailing lists, and that a domain whose users post to mailing lists should not publish it. A dedicated cold email domain that nobody uses for lists is a better fit than your main company domain. Use test mode (t=y) while you check a change, and remember Google's guidance that a policy of p=none is acceptable for the bulk sender requirement, so a domain that stays at none still satisfies Google's DMARC requirement.

How do you read DMARC reports?

We did not read the report format, which RFC 9989 leaves to a companion document, so this section is practice. The reports are produced by receiving mail systems and sent to your rua address, and they are meant for software rather than people. Google suggests a dedicated mailbox or a third-party reporting service. When you go through what comes back, the questions to ask are two: is any sending source I recognise failing SPF or DKIM alignment, and is any source I do not recognise sending mail as my domain? The first is a setup to fix before you tighten the policy. The second is the reason DMARC exists.

Should a cold email domain have its own DMARC record?

Yes, for each domain that sends. Whether to send cold email from a separate domain is practice, not a rule in any page we read, and Google counts subdomains toward the same primary domain when it works out bulk-sender status, as our bulk sender rules post sets out from Google's FAQ. The sp tag sets a policy for existing subdomains from the parent record. Volume limits and warm-up are in how many cold emails per day.

What does this mean for MAJ Leads?

We are building cold email into MAJ Leads now, so this page is the checklist a sending domain has to pass, not a report on live sending. We have no deliverability results from MAJ sending to publish. Where the product stands today is on how it works, and plans are on pricing.