How to set up DMARC without breaking your own email
DMARC done in one step blocks your own invoices. The staged method: inventory senders, monitor, read reports, fix, then tighten to quarantine and reject.
The short answer
DMARC is the record that turns SPF and DKIM from advice into enforcement: it tells receiving mail servers what to do when an email claiming to be from your domain fails those checks, and it sends you reports about every source that sends as you. The goal is a policy of reject, so nobody can send as your domain. The danger is getting there in one step, before you know every legitimate system that sends email in your name.
The method below takes weeks of patience and minutes of actual work, and it does not break anything.
The staged method
- Inventory every sender. Mail provider, newsletter, CRM, invoicing, helpdesk, booking, e-signature, website forms, calendar, monitoring alerts. Ask every department. The list is always longer than expected.
- Get each sender aligned. Add its sending servers to SPF, staying under the lookup limit, and enable DKIM signing with your domain in each tool. Tools provide the records to copy.
- Publish DMARC at none. A policy of none changes nothing for delivery. It switches on the reports, sent to an address or service you choose.
- Read the reports for several weeks. Every legitimate source that fails is a tool you missed or misconfigured; fix it. Every unknown source is either shadow IT or spoofing; investigate.
- Move to quarantine. Failing email now goes to spam at receivers that honour the policy. Watch the reports for a few more weeks; any complaint from a colleague means a sender was missed.
- Move to reject. Failing email is refused. Keep the reports flowing; new tools get added to SPF and DKIM before they send their first message.
Where it goes wrong
| Mistake | What happens | Prevention |
|---|---|---|
| Reject on day one | Invoices, quotes or alerts from a missed tool are refused by customers’ mail servers, silently | Stages 3 and 4 |
| SPF over the lookup limit | SPF fails for everything, and DMARC then relies on DKIM alone | Flatten or consolidate includes; check the limit |
| DKIM enabled but not aligned | The tool signs with its own domain; DMARC still fails | Configure the tool with your domain’s key |
| Website form sends as your domain unsigned | Contact form emails go to spam or are rejected | Send through an authorised service with DKIM |
| Nobody reads the reports | Failures and spoofing go unnoticed for months | A reporting service and a named owner |
What the reports give you beyond safety
Once the reports flow, you learn which systems send as your company, which is usually more than anyone knew, and you see any spoofing attempts as unknown sources failing the checks. Both are useful management information. Keep the reports flowing after reaching reject; they are the early warning when someone adds a tool without telling anyone.
What this means for you
If your domain has no DMARC record, start today at none with reporting on; it costs nothing and risks nothing. If it has a record at none that nobody reads, the reports are the work; assign an owner. If it is at reject and email has been odd since, the inventory step was skipped, and the reports will show which sender is failing. In all three cases, the staged order gets you to a domain nobody can spoof without breaking your own mail on the way.
Frequently asked questions
Why not go straight to reject if that is the goal?
Because you do not yet know every system that sends email as your domain. Invoicing, CRM, newsletter, helpdesk, booking tool, website forms: each must pass SPF or DKIM aligned to your domain. Any one you missed has its email refused by receivers the moment you set reject. The monitoring stage is how you find them without breaking anything.
What do the reports look like and who reads them?
Aggregate reports arrive daily from receivers as machine-readable files listing sending sources and pass or fail results. They are not meant to be read raw. Use a reporting service or have your web partner collect and summarise them. The summary you want is: which sources sent as us, and which of them fail.
How long should we stay in monitoring mode?
Long enough to see every legitimate sender at least once, including the monthly invoice run and the quarterly newsletter. For a small business that is several weeks. Move to quarantine when the reports show only known sources passing, and to reject when quarantine has been quiet for a few more weeks.
Can DMARC break email sent through our website's contact form?
Yes, if the form sends email 'from' your domain through a service that is not authorised in SPF or signing with DKIM. The fix is to send through an authorised service with DKIM, or to send from a service address and put the visitor's address in reply-to. This is one of the most common failures the reports surface.
Sources
- DMARC.org: Overview (accessed 2026-09-11)
- Cloudflare Learning Center: DMARC, DKIM and SPF (accessed 2026-09-11)