What is DMARC, is it now required, and how do I add it?

15 October 2026 · By John Carlsson

DMARC is an email authentication, policy and reporting protocol that builds on SPF and DKIM. Gmail requires it if you send more than 5,000 messages a day to Gmail accounts, Microsoft requires it for domains sending 5,000 or more messages to Outlook.com, and Yahoo requires it of bulk senders. You add it as a DNS TXT record at _dmarc.yourdomain, starting with p=none and moving to quarantine and reject.

What DMARC does

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. dmarc.org describes it as an email authentication, policy and reporting protocol. It does not replace SPF or DKIM. It builds on them and links them to the domain shown in the From address that people actually see.

A DMARC record does two jobs:

It tells receiving mail servers what to do with a message that fails the check: nothing (none), treat it as suspicious (quarantine, usually the junk folder) or refuse it (reject).
It asks receivers to send you reports, so you can see every service sending email as your domain and whether it passed SPF and DKIM.

Is DMARC now required?

For bulk senders, yes. Google's email sender guidelines, in force since February 2024, say anyone sending more than 5,000 messages a day to Gmail accounts must:

set up SPF and DKIM, not just one of them
publish a DMARC record (a policy of none is accepted)
make sure the From domain aligns with either the SPF domain or the DKIM domain
support one-click unsubscribe on marketing messages and keep the spam rate in Postmaster Tools below 0.3%

Yahoo's sender best practices set the same standard for bulk senders from February 2024: a valid DMARC policy of at least p=none that passes, with relaxed alignment acceptable. Microsoft's Outlook.com help page says domains sending 5,000 or more messages to its consumer services must pass SPF and DKIM and publish a valid DMARC policy, or messages are rejected with the error 550 5.7.515.

If you send less than that, the big providers do not insist on DMARC, but Google still requires all senders to have SPF or DKIM, and the NCSC recommends DMARC for every domain you own.

How to add DMARC

Check SPF and DKIM first. List every service that sends email for you (your mailbox provider, website, newsletter tool, invoicing system) and make sure each one is covered.
Choose a mailbox for reports. Aggregate reports from major providers usually start arriving within 24 hours, according to the NCSC.
In your DNS provider, add a TXT record with the name _dmarc (so the full name is _dmarc.yourdomain.co.uk) and a monitoring policy as the value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk
Read the reports. Fix any legitimate service that fails SPF or DKIM. The NCSC says to take your time at this stage.
Move to quarantine once your genuine mail passes: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.co.uk
Move to reject, phasing it in with the pct tag. The NCSC example applies reject to half of failing mail, with the rest quarantined: v=DMARC1;p=reject;sp=reject;fo=1;pct=50;rua=mailto:dmarc-reports@yourdomain.co.uk. Raise pct towards 100 as you confirm genuine email is still delivered. The pct tag comes from the original DMARC specification. The updated standard, RFC 9989 (May 2026), removes it, so newer receivers may ignore it. Do not rely on pct alone, and move to a full p=reject once your reports are clean.

The NCSC notes that many organisations take about three months to move from quarantine to reject, and recommends watching reports closely for at least two weeks after switching to reject. If something breaks, go back to quarantine.

Common mistakes

Leaving out mailto: in the rua tag. dmarc.org lists this as a common error.
Changing several settings at once. dmarc.org advises changing one setting at a time.
Jumping straight to reject before checking reports, which can block your own invoices or newsletters.
Forgetting the DKIM key length. Google requires a key of at least 1024 bits for personal Gmail accounts and recommends 2048 bits where possible.

Our Security Audit checks your domain's SPF, DKIM and DMARC records alongside its HTTP security headers, so you can confirm the record is published and readable after you add it.

Sources

Frequently asked questions

Will a DMARC policy of p=none protect my domain?

Not on its own. dmarc.org explains that p=none means you are not asking receivers to take any action when a message fails the DMARC check. What you do get is aggregate reports, which show who is sending email as your domain. That is why it is the right starting point, but the NCSC treats it as a monitoring stage before quarantine and then reject.

Should I add DMARC to a domain that does not send email?

Yes. The NCSC advises publishing DMARC records for all of your domains, including parked domains, whether or not they send email. A domain that never sends mail can be spoofed just as easily as one that does, and a published policy tells receivers how to treat messages that claim to come from it.