Resources & Documentation
Everything you need to master email authentication and get the most out of DMARC Examiner.
Getting Started Guide
Follow these six steps to implement DMARC protection for your domain.
Verify SPF Exists
Check if your domain already has an SPF record. Most domains using Google Workspace or Microsoft 365 already have one. Use a DNS lookup tool or ask your IT team.
Configure DKIM
Enable DKIM in your email provider (Gmail, Outlook, SendGrid, etc.). DKIM signs your emails cryptographically to prove they are legitimate.
Create DMARC Record
Register your domain in DMARC Examiner to get your unique token. Add the DMARC TXT record to your DNS pointing reports to our system.
Configure Report Address
In your DMARC record, set rua=mailto:YOUR_TOKEN@reports.dmarc-examiner.com. This tells email providers where to send authentication reports.
Wait for Reports
DNS propagation takes 1-24 hours. Email providers send aggregate reports every 24 hours. First reports typically arrive within 24-48 hours.
Analyze & Improve
Review reports in your dashboard, identify legitimate sources, fix any authentication issues, then gradually move from p=none to p=quarantine to p=reject.
Your DMARC Reports Address
When you register your domain, we will provide a unique token. Use this format in your DMARC record's rua= parameter:
YOUR_TOKEN@reports.dmarc-examiner.com Important Notes:
- • Replace
YOUR_TOKENwith the unique token provided after domain registration - • Reports are sent by email providers (Gmail, Outlook, Yahoo, etc.) every 24 hours
- • We automatically process and visualize these reports in your dashboard
- • You never need to manually check this email - we handle everything
How DMARC Reports Work
Understand the complete flow from sending an email to analyzing reports.
Send Email
Your server sends an email from your domain
Verify DMARC
Receiving server checks DMARC, SPF, DKIM
Generate Report
Provider creates aggregate report (24h)
Send Report
Report sent to your rua= address
Analyze
DMARC Examiner processes and displays insights
Send Email
Your server sends an email from your domain
Verify DMARC
Receiving server checks DMARC, SPF, DKIM
Generate Report
Provider creates aggregate report (24h)
Send Report
Report sent to your rua= address
Analyze
DMARC Examiner processes and displays insights
DNS Configuration Examples
Copy these DNS record examples to configure DMARC and SPF for your domain.
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:{token}@reports.dmarc-examiner.com"Start with p=none to monitor without affecting delivery. This allows you to identify all legitimate email sources first.
v=DMARC1DMARC version identifierp=nonePolicy: monitor only, don't reject/quarantine emailsrua=mailto:...Where to send aggregate reports (daily summaries)_dmarc.example.com TXT "v=DMARC1; p=quarantine; pct=10; rua=mailto:{token}@reports.dmarc-examiner.com"After monitoring, gradually quarantine suspicious emails. Start with 10% (pct=10) and increase slowly.
p=quarantinePolicy: send suspicious emails to spam/junk folderpct=10Apply policy to 10% of emails (increase gradually)_dmarc.example.com TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; pct=100; rua=mailto:{token}@reports.dmarc-examiner.com"Full protection: rejects all unauthenticated emails. Use only after thoroughly analyzing reports and fixing legitimate sources.
p=rejectPolicy: reject all unauthenticated emailssp=rejectSubdomain policy: also reject for subdomainsadkim=sStrict DKIM alignmentaspf=sStrict SPF alignmentpct=100Apply to 100% of emailsexample.com TXT "v=spf1 include:_spf.google.com ~all"SPF authorizes which servers can send email for your domain. This example allows Google Workspace.
v=spf1SPF version identifierinclude:_spf.google.comAuthorize Google servers to send emails~allSoftfail other servers (mark as suspicious but don't reject)example.com TXT "v=spf1 include:_spf.google.com include:amazonses.com include:_spf.salesforce.com -all"SPF record authorizing multiple email providers. Use -all for strict protection.
include:amazonses.comAuthorize Amazon SESinclude:_spf.salesforce.comAuthorize Salesforce Marketing Cloud-allHardfail: reject emails from unauthorized serversImportant Note
Replace {token} with the unique token provided by DMARC Examiner when you register your domain. Replace example.com with your actual domain name.
DMARC Guide
Learn everything about DMARC, SPF, and DKIM email authentication.
DMARC Implementation Roadmap
Follow this proven path from monitoring to full email protection.
1. Start with p=none
Begin in monitoring mode to understand your email sources without affecting delivery.
2. Analyze Reports
Review DMARC reports to identify legitimate senders and potential issues.
3. Fix Authentication
Ensure all legitimate email sources are properly configured with SPF and DKIM.
4. Move to p=quarantine
Start quarantining suspicious emails that fail authentication.
5. Enforce with p=reject
Achieve full protection by rejecting all unauthenticated emails.
Latest from Our Blog
Insights, tutorials, and best practices for email security.
Your Remote MCP Server Will Fail Every Directory Check. Here Is Why
MCP directories verify a server by starting it in a container with no browser. A remote server that authorizes at startup times out and gets no score. The fix, with the logs from five failed build tests and the change that fixed them.
Multiple SPF Records: Why Two Break Your Email (and How to Merge Them)
You can only have one SPF record per domain. Learn how to merge multiple SPF records into one, which providers actually belong in it, and why receiving services do not.
Cheapest DMARC Monitoring Tools in 2026
Published prices for six DMARC monitoring tools, checked in July 2026: DMARC Examiner, Red Sift OnDMARC, PowerDMARC, DMARCeye, dmarcian and EasyDMARC. Cost per domain, what each free tier includes, and which one fits your case.
Frequently Asked Questions
Everything you need to know about DMARC implementation and email authentication.
Basics
What is DMARC and why do I need it?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that protects your domain from being used for email spoofing, phishing, and impersonation attacks. It builds on SPF and DKIM to give you control over how email receivers handle unauthenticated emails. Without DMARC, attackers can easily send fake emails that appear to come from your domain, damaging your brand reputation and tricking your customers.
Setup
How do I configure DMARC for my domain?
First, ensure you have SPF and DKIM configured. Then: 1) Register your domain in DMARC Examiner to get a unique token, 2) Add a TXT record at _dmarc.yourdomain.com with the DMARC policy we provide, 3) Point rua= to your-token@reports.dmarc-examiner.com, 4) Wait 24-48 hours for DNS propagation and first reports to arrive.
Do I need to configure SPF and DKIM first?
Yes, DMARC relies on SPF and/or DKIM to verify email authenticity. Most email providers (Google Workspace, Microsoft 365, SendGrid) automatically configure DKIM when you set up your domain. SPF is usually a simple TXT record listing authorized email servers. DMARC will not provide protection without at least one of these in place.
Reports
What are RUA and RUF reports?
RUA (Aggregate Reports) are daily XML summaries sent by email receivers showing all authentication results for emails from your domain. They include volume, pass/fail statistics, and source IPs. RUF (Forensic Reports) provide detailed information about individual failed messages, including headers and content samples. Most providers only send RUA reports; RUF reports are increasingly rare due to privacy concerns.
How long does it take to receive reports?
Email providers (Gmail, Outlook, Yahoo, etc.) generate aggregate reports every 24 hours. After adding your DMARC record, DNS propagation takes 1-24 hours. Expect your first reports within 24-48 hours. If you send very few emails, reports may take longer or arrive irregularly.
What if I am not receiving reports?
Check these common issues: 1) Verify your DNS record is correct using online DNS lookup tools, 2) Ensure your rua= email address matches your token from DMARC Examiner, 3) Wait at least 48-72 hours after adding the record, 4) Confirm you are actually sending emails from your domain, 5) Check if your DNS provider requires additional configuration for TXT records.
Implementation
How long does DMARC implementation take?
Adding the initial DMARC record takes minutes, but achieving full protection (p=reject) typically requires 2-6 months. Start with p=none to monitor for 2-4 weeks, identify all legitimate email sources, fix any authentication issues, move to p=quarantine for another 2-4 weeks while monitoring, then finally enforce with p=reject once you are confident all legitimate emails pass.
Will DMARC break my legitimate emails?
Not if implemented correctly. Start with p=none (monitoring mode) which never affects email delivery. This lets you identify all legitimate email sources and fix authentication issues before enforcing. Common sources that need fixing: marketing platforms, ticketing systems, CRM tools, and forwarded emails. Only move to p=quarantine or p=reject after thorough monitoring.
What does p=none, p=quarantine, and p=reject mean?
These are DMARC policy levels: p=none means "monitor only" - receivers log results but deliver all emails normally. p=quarantine means "send suspicious emails to spam/junk" - failed emails go to spam folder. p=reject means "block all unauthenticated emails" - failed emails are rejected completely. Always start with p=none, then gradually move to stricter policies.
Technical
What do pass/fail results in reports mean?
Pass: Email successfully passed DMARC authentication by aligning with SPF and/or DKIM. This indicates a legitimate, properly configured sender. Fail: Email failed authentication, meaning the From: domain doesn't align with SPF/DKIM. This could be a spoofing attempt, or a legitimate source with misconfigured authentication. Review failed sources carefully before blocking them.
What is SPF alignment vs DKIM alignment?
Alignment means the domain in the visible From: header matches the domain authenticated by SPF or DKIM. Relaxed alignment allows subdomains (email@sub.example.com passes for example.com). Strict alignment requires exact match. DMARC passes if either SPF or DKIM aligns. Use relaxed alignment (default) unless you have specific security requirements.
DMARC Examiner
How does DMARC Examiner process my reports?
Email providers send DMARC reports to the address in your rua= tag (your-token@reports.dmarc-examiner.com). We automatically receive these XML reports, parse the complex data, aggregate statistics across all sources, identify trends and issues, and present everything in an easy-to-understand dashboard with actionable recommendations. You never need to manually process or read XML files.
Is my email data secure and private?
Yes. DMARC aggregate reports contain statistics only (volume, pass/fail counts, source IPs) with no email content, subject lines, or recipient information. We process reports securely, never access your actual emails, store data encrypted, and never share your information with third parties. Reports are tied to your account via a unique token.
Troubleshooting
Why are legitimate emails failing DMARC?
Common causes: 1) SPF broken by forwarding (forwarded emails change the sender IP), 2) DKIM not configured for a specific sending service, 3) Email sent through unauthorized server not listed in SPF, 4) Subdomain alignment issues (email from sub.domain.com not matching domain.com), 5) Third-party service (CRM, marketing platform) sending on your behalf without proper setup. Review the failing source in your dashboard and fix authentication.
What happens if my DMARC policy is too strict?
If you set p=reject without proper monitoring, legitimate emails from misconfigured sources will be blocked completely. This can break critical systems: order confirmations, password resets, support tickets, automated reports, etc. Always start with p=none, monitor for weeks, fix all legitimate sources, test with p=quarantine, and only then move to p=reject. DMARC Examiner alerts you to potential issues before they become problems.
Ready to Get Started?
Set up DMARC monitoring for your domain in just a few minutes.
Start Free Trial