Start with a sender inventory
Identify employee mail, newsletters, website notifications, invoicing, customer-management systems, and any other approved sender. Record who owns each connection.
Confirm SPF and DKIM before enabling DMARC. Google recommends preparing authentication and reviewing existing records in its DMARC setup guide.
Understand alignment
DMARC passes when either SPF or DKIM passes with an authenticated domain aligned to the visible From domain. Both methods do not have to pass for DMARC to pass, as explained in Google’s documentation.
Test real messages from each service. Forwarding and vendor sending configurations can complicate results, so review message headers before assuming that a DNS change is sufficient.
Choose the reporting destination
A DMARC DNS record can request aggregate reports through the rua tag. Google recommends a dedicated mailbox, group, or reporting service because reports can be numerous in its setup guidance.
Make sure someone is responsible for reviewing the reports and protecting the data they contain. Confirm any requirements for receiving reports at a different domain.
Roll out the policy carefully
Google recommends starting with a monitoring policy and reviewing authentication before moving toward quarantine or reject in its rollout guidance.
A monitoring policy does not guarantee delivery, and a stricter policy can affect legitimate mail that is not aligned. Choose the next step from observed results and the status of approved senders.
Keep the configuration current
When a new email tool is introduced, add it to the inventory and test its authentication before regular use. Retire unused senders with the system owner’s approval.
Save the DNS change history and document how to respond if legitimate mail starts failing. Treat DMARC as part of ongoing email administration rather than a one-time record to paste in.