A strong DMARC record enforces a policy, reports to a monitored mailbox, and covers subdomains — for example: v=DMARC1; p=reject; rua=mailto:[email protected]; sp=reject; adkim=s; aspf=s. Start softer (p=none) while you authenticate senders, then tighten to this.
Enforce with p=reject, collect data with rua, protect subdomains with sp=reject, and require strict alignment with adkim=s; aspf=s once your senders are aligned. Add np=reject to cover non-existent subdomains.
Begin at p=none with only rua so you can discover senders without blocking mail. Tighten progressively as reports confirm alignment.
See where you stand:
$ dig TXT _dmarc.yourdomain.com +shortCheck your DMARC record now
Open the free DMARC checker →Only once all legitimate senders align — strict (s) is safest for tightly controlled sending, but can bounce aligned-by-subdomain senders if applied too early.
