--- title: "DMARC best practices: Simple steps to protect your domain from email fraud | DuoCircle" description: "DMARC best practices: Simple steps to protect your domain from email fraud." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/" --- Quick Answer DMARC best practices are: start at p=none to monitor without affecting delivery, use that period to discover every legitimate sender (CRMs, marketing platforms, payroll, ticketing), then move to p=quarantine after two to three weeks once authorized senders are passing SPF or DKIM, and finally to p=reject. Read aggregate reports regularly; they arrive as XML and need a parser to be useful. Confirm SPF and DKIM alignment for every sending service: the domain in From has to match the SPF Return-Path or the DKIM d= value. Update DNS as the sender list changes. Skipping the phased rollout is the most common reason organizations break their own legitimate mail and roll back to p=none. DMARC best practices: Simple steps to protect your domain from email fraud Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2025/09/DMARC-best-practices-Simple-steps-to-protect-your-domain-from-email-fraud.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=DMARC%20best%20practices%3A%20Simple%20steps%20to%20protect%20your%20domain%20from%20email%20fraud&url=undefined%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F&title=DMARC%20best%20practices%3A%20Simple%20steps%20to%20protect%20your%20domain%20from%20email%20fraud "Share on Reddit") [ ](mailto:?subject=DMARC%20best%20practices%3A%20Simple%20steps%20to%20protect%20your%20domain%20from%20email%20fraud&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F "Share via Email") ![DuoCircle blog post image](https://media.mailhop.org/duocircle/images/2025/09/spf-record-generator-8901.jpg) [DMARC adoption](/dmarc/dmarcbis-adoption-it-leaders-cisos-domain-owners-need-to-know/) is on the rise, especially since Google and Yahoo made it **mandatory for bulk users**. However, it is also true that many domain owners have not figured it out correctly because they don’t follow the best practices associated with it. DMARC is a **complex and sensitive protocol** that needs regular attention; otherwise, you won’t get the full benefits and might even face compliance issues. Here are the top [DMARC](https://dmarcreport.com/what-is-dmarc/) best practices that every domain owner should follow. ## Start with p=none When you are in the initial phase of DMARC implementation, it’s important that you don’t jump straight into blocking [suspicious emails](https://thehackernews.com/2024/07/proofpoint-email-routing-flaw-exploited.html). It’s recommended that you **start with p=none**, which is the default monitoring policy, so that you gain deep visibility into who is sending emails from your domain. [![CRMs ](https://media.mailhop.org/duocircle/images/2025/09/spf-record-6655.jpg)](https://media.mailhop.org/duocircle/images/2025/09/spf-record-6655.jpg) _This policy doesn’t block or quarantine potentially fraudulent emails; instead, it acts as a safety net, allowing you to watch your emails without disrupting the communication flow_. Basically, the ‘none’ mode helps you **confirm which legitimate services** are sending emails on your behalf, such as [CRMs](https://www.ibm.com/think/topics/crm), marketing platforms, or payroll systems including [paystub](https://paystub.org/) services that handle employee records.. It also helps uncover forgotten or outdated mail servers still in use. ## Analyze DMARC reports regularly Once the p=none policy is applied, the real value comes from the [DMARC aggregate reports](/resources/dmarc-aggregate-report) you receive (not that these reports are not important when you apply the reject or quarantine policy). _These reports reveal which servers are sending emails on behalf of your domain, helping you distinguish between trusted sources and unauthorized ones_. If you regularly receive and analyze the [DMARC reports](/content/dmarc-report), you won’t miss the red flags indicating suspicious emails. Please note that since these reports are in XML format, you will need to use tools that translate the data into **easy-to-understand dashboards**. [![suspicious emails](https://media.mailhop.org/duocircle/images/2025/09/spf-record-check-6655.jpg)](https://media.mailhop.org/duocircle/images/2025/09/spf-record-check-6655.jpg) ## Gradually move to p=quarantine, then p=reject Don’t apply the reject policy right from the beginning; it can backfire by blocking legitimate emails if something is misconfigured. Instead, adopt a phased approach. After setting the monitoring mode for around 2-3 weeks, switch to the quarantine mode so that you can instruct the receiving [mail servers](https://www.activecampaign.com/glossary/mail-server) to place suspicious emails in the [spam folder](https://cybernews.com/news/microsofts-breach-notification-emails-end-up-in-spam-folder/). This step gives you time to confirm that only bad traffic is being caught. Once you’re confident everything is aligned, move to “reject” for maximum [email security](/) and protection. This gradual enforcement strategy balances security with continuity, ensuring you **keep communication smooth** while steadily shutting down spoofers and fraudsters. [![Risks of Skipping Phased Email Security](https://media.mailhop.org/duocircle/images/2025/09/what-is-dkim-selector-0001.jpg)](https://media.mailhop.org/duocircle/images/2025/09/what-is-dkim-selector-0001.jpg) ## Align SPF and DKIM with DMARC DMARC works best when it’s paired with **both SPF and DKIM. Alignment** means the domain used in SPF and [DKIM checks](https://autospf.com/10-reasons-for-regular-spf-record-checks-in-cybersecurity/dkim-record-check/) matches the domain in the ‘From’ address that users see. Without this, even legitimate emails can fail authentication. _Let’s say your marketing tool sends emails using its own domain and not yours, then the alignment will break_. To avoid this kind of disruption, configure all authorized sending services to sign messages with your domain. It’s also important that you regularly update [DNS records](https://www.cloudflare.com/learning/dns/dns-records/) as new tools are adopted. Having **DMARC alignment ensures** you have a solid foundation for blocking email abuse. ## Topics DKIMDMARCemail securitySecurityspf ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F) [ ](https://twitter.com/intent/tweet?text=DMARC%20best%20practices%3A%20Simple%20steps%20to%20protect%20your%20domain%20from%20email%20fraud&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fdmarc-best-practices-steps-protect-your-domain-from-email-fraud%2F) Copy Related Articles - [ ![BIMI](https://media.mailhop.org/duocircle/images/2025/06/spf-permerror-0123.jpg) Avoiding common BIMI pitfalls: What goes wrong and how to fix it DMARC ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/) - [ ![Can threat actors bypass DMARC](https://media.mailhop.org/duocircle/images/2025/02/dmarc-generator-7302.jpg) Can threat actors bypass DMARC? DMARC ](/blog/dmarc/can-threat-actors-bypass-dmarc/) - [ ![SPF, DKIM, and DMARC requirements](https://media.mailhop.org/duocircle/images/2025/07/sendgrid-alternative-8960.jpg) Cloudflare’s new SPF, DKIM, and DMARC requirements DMARC ](/blog/dmarc/cloudflares-new-spf-dkim-and-dmarc-requirements/) - [ ![Deploying DMARC](https://media.mailhop.org/duocircle/images/2026/02/spf-record-7890.jpg) Deploying DMARC the right way: Here’s what MSPs and enterprises should know DMARC ](/blog/dmarc/deploying-dmarc-correctly-what-msps-and-enterprises-must-know/) ## Related Articles [ DMARC 6m Avoiding common BIMI pitfalls: What goes wrong and how to fix it Jun 24, 2025 ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/)[ DMARC 3m Can threat actors bypass DMARC? Feb 21, 2025 ](/blog/dmarc/can-threat-actors-bypass-dmarc/)[ DMARC 7m Cloudflare’s new SPF, DKIM, and DMARC requirements Jul 18, 2025 ](/blog/dmarc/cloudflares-new-spf-dkim-and-dmarc-requirements/)[ DMARC 6m Deploying DMARC the right way: Here’s what MSPs and enterprises should know Feb 26, 2026 ](/blog/dmarc/deploying-dmarc-correctly-what-msps-and-enterprises-must-know/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC best practices: Simple steps to protect your domain from email fraud","description":"DMARC best practices: Simple steps to protect your domain from email fraud.","url":"https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/","datePublished":"2025-09-19T15:22:42.000Z","dateModified":"2025-12-19T16:39:46.000Z","dateCreated":"2025-09-19T15:22:42.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, email security, Security, spf","wordCount":533,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/09/spf-record-generator-8901.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"DMARC best practices: Simple steps to protect your domain from email fraud","item":"https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"DMARC best practices: Simple steps to protect your domain from email fraud","item":"https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC best practices: Simple steps to protect your domain from email fraud","description":"DMARC best practices: Simple steps to protect your domain from email fraud.","url":"https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/","datePublished":"2025-09-19T15:22:42.000Z","dateModified":"2025-12-19T16:39:46.000Z","dateCreated":"2025-09-19T15:22:42.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/dmarc-best-practices-steps-protect-your-domain-from-email-fraud/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, email security, Security, spf","wordCount":533,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/09/spf-record-generator-8901.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```