Deliverability runbook · Intermediate · 15 minutes plus a monitoring month
How to publish a DMARC policy — DMARC as Telemetry First, Enforcement Second
You need enforcement because the large receivers now expect it, and you have no idea which of your own systems would start bouncing the moment you switch it on.
The short answer
DMARC's first job is measurement rather than blocking: a p=none record turns on aggregate reporting, so you can see every source sending as your domain and whether SPF or DKIM aligns for it, before any policy changes a single delivery decision.
Enforcement is then a ratchet you control with pct=, moving ten, twenty-five, fifty and finally a hundred per cent of failing mail into quarantine and then reject. The month of reports in between is the entire reason the rollout does not take the invoicing system down with it.
By the HostingFast team · Reviewed 24 August 2026
Intermediate
Difficulty grade
5
Stages
Free
Support cost
Proven
Verified on
Assumed knowledge: you can add a TXT record and you already have SPF and DKIM passing. DMARC does not re-test either of them; it tests whether the pass belonged to the domain your recipient actually reads.
Every stage of this is reversible inside one DNS TTL, which is why the TTL on the record deserves a decision rather than a default. Nothing here changes inbound mail or internal delivery.
What alignment means, precisely
DMARC does not check SPF or DKIM again. It checks whether a pass that already happened was for the same domain as the From: header the recipient sees. SPF alignment compares the envelope sender's domain; DKIM alignment compares the d= tag. One aligned pass is enough for the message to survive.
Relaxed alignment, which is the default, accepts an organisational match, so mail.yourdomain aligns with yourdomain. Strict alignment — aspf=s, adkim=s — demands an exact match, and it is the setting that quietly breaks every subdomain sender you forgot about.
Publishing the record and turning the reports on
One TXT record at _dmarc.yourdomain reading v=DMARC1; p=none; rua=mailto:reports@yourdomain. That alters nothing about delivery, and it starts a daily XML feed arriving from every large receiver that supports the standard.
Point rua at an address somebody will genuinely process, and put a parser in front of it. Raw aggregate XML is machine output, and a free parsing service turns a month of it into a ranked list of sources with pass rates attached — which is the artefact the rest of this job runs on.
Reading the reports, then ratcheting
The reports name each sending IP, the volume it sent, and the SPF and DKIM verdicts with alignment applied. Work down the list by volume until every meaningful source is either fixed, retired, or recognised as somebody impersonating you.
Then move in measured steps: p=quarantine with pct=10, watch a week, raise the percentage, and only then p=reject. Each increment is a DNS edit, so the worst case is a wait as long as your TTL rather than an incident.
What the record cannot do for you
DMARC has no effect on inbound mail, none on internal delivery, and none at all on a receiver that ignores it. It also cannot rescue a forwarded message whose SPF broke and whose signature was stripped — ARC exists precisely for that gap, and it is implemented by the receiving side, not by you.
Where DNS is hosted with us the record is one line in the zone editor, and support will read a parsed month of aggregate reports with you before you touch pct=. That review is the part people skip, and it is the part that decides whether enforcement is uneventful.
The platform these checks were run against
Every screen and record in this guide was exercised on the stack we operate: cPanel, LiteSpeed, NVMe storage, one-click installs. The zone editor in the screenshots is the zone editor in your account.
Every plan ships with a free SSL certificate that renews itself ahead of expiry, so the padlock is never a thing you have to diary.
- Telemetry before enforcement
- Every stage reversible in one TTL
- Reports parsed, not skimmed
- Engineers on shift at any hour
Why HostingFast
Standard on every plan
Telemetry before enforcement
Reports start arriving before any policy changes a delivery, which is the entire reason to begin at p=none.
pct= is a dial, not a switch
Enforcement moves in increments you choose, each one reversible inside a single DNS TTL.
Alignment defined precisely
Relaxed against strict, envelope against From:, stated rather than assumed to be obvious.
Aggregate XML made readable
Raw reports are machine output, and the guide says what to point at them instead of describing the format.
The forwarding gap acknowledged
What DMARC cannot fix is named, so you do not spend a fortnight chasing a mailing list.
Support that reads a month of reports
Send the parsed summary before you touch pct= and an engineer goes through it with you.
Quick Start
From order to online
- 1
Get SPF and DKIM aligned first
DMARC only judges alignment, so a domain where neither mechanism passes for your own name has nothing to enforce. Fix the authentication before publishing any policy.
- 2
Publish p=none with a working rua address
v=DMARC1; p=none; rua=mailto: an address you will read. Delivery is untouched; the only change is that reports start arriving the following day.
- 3
Parse a month of aggregate reports
Feed the XML to a parser and rank the sources by volume. A month is long enough to catch senders that only fire weekly or monthly, which is exactly where the surprises live.
- 4
Ratchet with pct= before changing p=
Move to quarantine at pct=10, then 25, then 50, watching between each. Percentage is the safety mechanism; jumping straight to p=reject is what turns this into an incident.
- 5
Keep the feed running after reject
Leave rua active and read it. New services and broken configurations appear in the reports weeks before anybody notices them as a delivery complaint.
Built In
Loaded onto every plan
- Mailboxes on your own domain, included with the plan
- Spam and virus screening on every mailbox as standard
- IMAP, POP, SMTP and browser webmail on every mailbox
- Engineers on shift every hour of every day, not a queue that opens at nine
- 99.9% uptime as the target, monitored around the clock
- Daily backups with restores you trigger yourself from the panel
- Staging environments for testing before anything ships
- NVMe SSD storage on every tier, not just the expensive ones
- Renewal billed at the rate you first signed up at
- No setup fee on any plan, ever
Frequently Asked
What people ask us most often
What is actually inside a DMARC aggregate report?
Message counts grouped by sending IP, each with SPF and DKIM verdicts and whether either aligned with your domain. There is no message content in them at all. What you get is a map of who sends as you and how their authentication performs, which is precisely the intelligence enforcement requires.
Why do forwarded messages fail DMARC when nothing else does?
Because forwarding usually breaks SPF — the forwarder becomes the connecting server — and any list that appends a footer breaks the DKIM body hash at the same time. With both broken there is no aligned pass left. ARC lets a receiver trust the forwarder's assessment of the original, but it is implemented at their end rather than yours.
Which company stands behind HostingFast?
HostingFast is a trading name of Vitalcare at Home Ltd, registered in England and Wales — a real company with a public record and terms governed by English law. Running that check on any host before handing over a domain is time well spent.
How many sites can one account carry?
From the Turbo tier up, yes — multiple sites, each with its own domain, mailboxes and certificate, all inside a single account. If the extra sites belong to clients rather than you, look at reseller hosting instead: it keeps each one properly walled off.
Keep reading
How to Set Up Domain Forwarding
Sending one hostname to another at the edge, with the redirect hop counted rather than assumed.
How to Take Payments Online
Card data kept off your own server, with the latency each checkout route adds weighed up.
SPF (Sender Policy Framework) (Glossary)
The mechanism DMARC judges for alignment, defined in one screen.
Web Hosting
cPanel hosting on NVMe with SSL, migration and a year-one domain included.
Domain Names
Register or move a name — the first year is included with an annual plan.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Enforce it once the numbers say so.
Shared to VPS to dedicated is a tier change on the same account rather than a migration to somewhere else.
View Web Hosting plans