---
title: "Enforce DMARC · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc
updated: 2026-10-20
licence: "All rights reserved"
---

# Enforce DMARC

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: Publish a DMARC record, read its reports, and move from `p=none` to `p=quarantine` and then `p=reject` once all mail passes.
- How: DMARC (RFC 9989, which replaced RFC 7489 in May 2026) passes when SPF or DKIM passes on a domain aligned with the visible `From`. Start with `p=none` and a `rua` address for aggregate reports (RFC 9990). Fix every source the reports show. Move to `p=quarantine` after two weeks of reports with every legitimate source passing. Move to `p=reject` after two more clean weeks. Set `np=reject` so made-up subdomains cannot be spoofed. The old `pct` tag is gone, so use `t=y` to test a stricter policy. Records still start with `v=DMARC1`. Gmail, Yahoo and Microsoft require at least `p=none` from bulk senders.
- Check: `dig +short TXT _dmarc.example.com` returns one record with `p=quarantine` or `p=reject`. Two weeks of aggregate reports show every legitimate source passing.

Example:

```dns
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; np=reject; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc`.

- Previous: [Sign every message with DKIM](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim)
- Next: [Lock down domains that never send mail](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)