Sending domain and authentication Required

Enforce DMARC

Publish a DMARC record, read its reports, and move from p=none to p=quarantine and then p=reject once all mail passes.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

DMARC (RFC 9989, which replaced RFC 7489 in May 2026) passes when SPF or DKIM passes on a domain aligned with the visible From. Start with p=none and a rua address for aggregate reports (RFC 9990). Fix every source the reports show. Then tighten the policy step by step. Set np=reject so made-up subdomains cannot be spoofed. The old pct tag is gone, so use t=y to test a stricter policy.

Example

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; np=reject; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"

How to check

dig +short TXT _dmarc.example.com returns one record with p=quarantine or p=reject. A week of aggregate reports shows every legitimate source passing.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc.