Question : How to Configure DMARC With Mailpro: 5-Step Safe Rollout

Setting up a DMARC record with Mailpro is the third pillar of email authentication, after SPF and DKIM. Done right, it stops domain spoofing, satisfies the 2024 sender requirements from Gmail and Yahoo, and gives you visibility into who is using your domain. Done in haste, it can block your own legitimate emails — that’s why we recommend a phased rollout.

Step 1 — Choose your starting policy

Always begin with p=none. This is the “monitor only” policy: no email is blocked, but you receive daily aggregate reports showing what passes or fails. Spend 2–4 weeks here, fix every authentication gap, then move forward.

Step 2 — Generate the TXT record in Mailpro

From your dashboard open Account → Authentication → DMARC and click Generate. Mailpro builds the record using best practices and shows you the exact value to publish in DNS:

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; pct=100; aspf=r; adkim=r

Step 3 — Publish in your DNS

Save the record and wait 5–30 minutes for DNS to propagate.

Step 4 — Read the aggregate reports

Receivers send daily XML reports to your rua address. They list every IP that sent on your behalf, and whether SPF/DKIM aligned. Use a free DMARC analyzer (Postmark, dmarcian, Mailpro’s built-in viewer) to spot rogue senders or misconfigured tools. See monitoring DMARC.

Step 5 — Tighten gradually

Once monitoring is clean, change p=none to p=quarantine; pct=25. After two stable weeks, raise to pct=50, then pct=100, and finally p=reject. This phased approach is what large enterprises use to avoid breaking business email.

Common errors and fixes

If your DMARC says “policy not enabled”, see our DMARC policy not enabled guide. Make sure SPF and DKIM are valid first.