Tool
DMARC record and rollout planner
Build the DMARC TXT record for your domain, then follow the eight-week schedule that moves it from monitoring to enforcement. Most domains publish p=none and stop there, which produces reports nobody reads and no protection against spoofing.
TXT record at _dmarc.example.com
v=DMARC1; p=quarantine; pct=25; sp=quarantine; rua=mailto:dmarc@example.com; fo=1; adkim=s; aspf=s;| Weeks 1–2 | p=none, collect aggregate reports, list every sender |
|---|---|
| Weeks 3–4 | Fix SPF includes and DKIM signing for each legitimate sender |
| Weeks 5–6 | p=quarantine at pct=25, then 50, watching report volume |
| Weeks 7–8 | p=quarantine at pct=100, then move to p=reject |
| Ongoing | Review aggregate reports monthly; re-check after any new sender |
Strict alignment (adkim=s, aspf=s) is deliberate: it fails loudly during rollout instead of quietly passing spoofed subdomains. sp mirrors p so subdomains are never a softer target. Forensic reports (ruf) are omitted because Google Workspace does not send them.
Publish the record at _dmarc.yourdomain as a TXT entry. Aggregate reports arrive as XML attachments to the mailbox in rua, so send them to a dedicated address rather than a person. Read them for two weeks before enforcing anything: they are the only reliable inventory of who sends mail as your domain.
Alignment is where most rollouts fail. A newsletter platform can pass its own SPF and DKIM while failing alignment because the visible From domain is yours and the signing domain is theirs. Fix that by delegating a subdomain and signing with your DKIM key.
What this doesn't cover
- This generates a record; it does not query DNS or verify what is currently published.
- BIMI and MTA-STS are separate records with their own prerequisites.
- Third-party senders you do not control may need their own vendor-side configuration.
Questions we get asked
- What DMARC record should I publish for Google Workspace?
- Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain; fo=1 to collect reports, then move to p=quarantine at pct=25 once every legitimate sender passes SPF and DKIM alignment.
- How long does a DMARC rollout take?
- Eight weeks for a typical estate: two weeks monitoring, two weeks fixing senders, then staged percentages at quarantine before reject. Rushing it bounces legitimate mail from marketing and billing tools.
Related pages
Want us to run the rollout?
We inventory every sender from your aggregate reports, fix alignment sender by sender, and take the domain to p=reject without dropping legitimate mail.