Setting up DMARC: step by step for Microsoft 365 and Google

Someone emails your customers on behalf of your domain name, and you haven't noticed. That is possible, because email doesn't check by default whether the sender is genuine. DMARC is the DNS record that tells receiving servers what to do with mail that pretends to be you. If you want to set up DMARC, there is more to it than pasting one line.

DMARC doesn't work on its own. It relies on SPF and DKIM, and if you set it to strict too soon, your own invoice emails end up in spam. In this article you go through the order that works, with examples for Microsoft 365 and Google Workspace, and the mistakes we see most often.

What DMARC does (and what it needs from SPF and DKIM)

Three records, three jobs:

• SPF says which servers may send mail on behalf of your domain.
• DKIM adds a digital signature to every message, so the recipient can see that the content wasn't changed in transit and that the sender holds the key.
• DMARC decides what happens when SPF and DKIM fail, and sends you reports about what is sent in your name.

One detail that is often overlooked: DMARC only passes if SPF or DKIM passes and its domain matches the domain in the visible From address. This is called alignment. A newsletter tool that has its own SPF and DKIM set up correctly, but sends from your address, can still make DMARC fail.

Not sure how DNS records work? Then first read DNS records explained: A, CNAME, MX and TXT. Everything below is a TXT or CNAME record.

Step 1: List everyone who sends email

This is the boring part, and it prevents most of the trouble. Write down which systems send mail with your domain as the sender:

• Microsoft 365 or Google Workspace (the regular mailboxes)
• your newsletter tool
• your accounting or invoicing software
• the contact form or web shop on your website
• CRM, helpdesk, scheduling tools

The contact form on your website is a classic. If WordPress sends the email directly from the web server with your address as the sender, that email will fail DMARC as soon as you enforce a strict policy. The clean fix is to send the form's email through your Microsoft 365 or Google account with an SMTP plugin. How to set up the email environment itself is covered in Setting up email with Microsoft 365 or Google Workspace.

Step 2: set up SPF correctly

SPF is a TXT record on the root name of your domain (in many DNS panels it appears as @). This is where it often goes wrong, because you may only have one SPF record. Two records means SPF fails completely.

For Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

For Google Workspace:

v=spf1 include:_spf.google.com ~all

If you also use a newsletter tool or another system, add its include: to that same record, not as a second record. That tool tells you which value it is. Also watch the limit of ten DNS lookups: each include: costs at least one. If you stack too many, SPF returns an error.

The difference between ~all (softfail) and -all (hardfail) is smaller than it seems, because DMARC decides the final outcome. Start with what the provider prescribes and make it stricter once everything runs stable.

Step 3: turn on DKIM

DKIM is not turned on automatically for a custom domain. You publish a key in DNS and then turn on signing in the management environment. That last click is the one most often forgotten.

DKIM in Microsoft 365

Microsoft uses two CNAME records. You can find the exact values in the Microsoft Defender portal, under the DKIM settings for your domain. The format is roughly like this:

selector1._domainkey.jouwdomein.nl points to the value that Microsoft shows.
selector2._domainkey.jouwdomein.nl same, with the second value.

Copy the values exactly as Microsoft gives them, even if they are strangely long. Add the records to DNS, wait until they are visible, then turn on the signing switch in the portal. If you get an error saying the CNAME was not found, DNS has usually not refreshed yet. Waiting a little helps.

DKIM in

In the Admin console, go to the Gmail settings and choose "Authenticate email". There you generate a new record for your domain. You get a TXT record with the name google._domainkey and a long value that starts with v=DKIM1; k=rsa; p=. Paste that in DNS and then click "Start authentication" in the Admin console.

Are you pasting a long key and does your DNS panel complain about the length? Some panels want the text in two pieces between quotation marks. Check the documentation of your DNS provider, or let us do it. In the customer portal you can add records yourself, see Managing DNS records in your portal.

Step 4: Set up DMARC with p=none

Only now do we get to DMARC itself. This is a TXT record on _dmarc.jouwdomein.nl. Always start with monitoring:

v=DMARC1; p=none; rua=mailto:dmarc@jouwdomein.nl

What does this say?

• v=DMARC1: the version, must come first.
• p=none: do nothing yet with email that fails, only report.
• rua=: the address where the summary reports are sent.

Be careful when filling in the name: many DNS panels add your domain automatically. In that case, only enter _dmarc or you will get _dmarc.jouwdomein.nl.jouwdomein.nl and your record does nothing.

The reports are XML files that recipients such as Google and Microsoft send daily. They are not easy for a person to read, and they can fill a regular mailbox quickly. So create a separate address for them or use a reporting tool that turns them into an overview. There you can see per sender whether SPF and DKIM pass.

Step 5: From p=none to reject without breaking your own email

Leave p=none in place for a few weeks, preferably long enough to include the monthly invoices and newsletters. Check the reports for legitimate senders that fail and fix those first: add an SPF include, turn on DKIM in the tool, or have the system send email via your main environment. Only when your own traffic is green do you lock it down.

You can make the interim step gradual with pct, the percentage of mail the policy is applied to:

1. v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@jouwdomein.nl
2. Check the reports and complaints for a week or two. Then increase to pct=50, then to 100 (or leave pct out).
3. v=DMARC1; p=reject; rua=mailto:dmarc@jouwdomein.nl

How long you stay on each step depends on how many systems send email. A small business with only Microsoft 365 or Google is sometimes done in a few weeks. With ten tools and a web shop, plan for more time. Rushing has no reward here, but rejected email does.

Common mistakes when setting up DMARC

• Two SPF records. Combine everything into one record.
• DKIM is in DNS, but not enabled. Without that last click, nothing gets signed.
• Going straight to p=reject. Then after a week you find out your accounting software was never included.
• The DMARC record on the wrong name. It must be on _dmarc, not on the root name.
• Forgetting subdomains. Without sp= a subdomain inherits the policy of the main domain. That is usually fine, but do check that tools on subdomains are set up correctly.
• Domains you don't use. An old or parked domain name that you don't send email from is an easy target for abuse. Set v=spf1 -all and v=DMARC1; p=reject on it.
• Never reading the reports. Then p=none is a record that protects nothing and teaches nothing.

Check that it works

Send a test email to a Gmail address, open the message and choose "Show original". There you see the result per check PASS of FAIL for SPF, DKIM and DMARC. Do this for every sender on your list, including the contact form. You can also get a quick look at your domain with our free website check, which checks email settings, among other things.

What to do now

1. Write down which systems send email from your domain.
2. Check that you have exactly one SPF record, with all senders in it.
3. Turn on DKIM in Microsoft 365 or Google Workspace and check that it works.
4. Publish p=none with a reporting address and leave it for a few weeks.
5. Fix senders that fail, move to quarantine with a low percentage, and then to reject.

If your domain name is with us and you'd rather not set up the records yourself, we set up the DNS for your email environment, including MX, SPF, DKIM and DMARC. If you use Google, you can also get your licenses through Google Workspace via Netslim, set up properly from the start.

Frequently asked questions

Is DMARC required for my domain name?

There is no legal requirement for every business. But large email providers are increasingly setting requirements for senders, especially if you send a lot of email. Without DMARC, you are also more likely to have others misuse your domain name and to have your email end up in spam.

How long does it take for a DMARC record to work?

The record is usually visible within a few minutes to a few hours, depending on the TTL of your DNS. The first reports often arrive only after a day or longer, because recipients send them in batches.

Can I set up DMARC without SPF and DKIM?

Technically, you can publish the record, but it makes little sense. DMARC evaluates the result of SPF and DKIM. If both are missing, all your legitimate email fails as soon as you tighten the policy.

Why does my newsletter end up in spam after I set up DMARC?

Usually the newsletter tool sends email with your address as the sender, but it is not included in your SPF record and does not sign with DKIM for your domain. Add the tool by following its instructions, then check in the reports whether the messages pass.