DMARC, explained in plain English
Everything we've written about getting your domain's email authenticated and keeping it that way — setup guides, fixes for specific bounces and errors, and honest tool comparisons.
Getting set up
- DMARC Setup Guide: How to Set Up DMARC (with Record Example)
A plain-English DMARC setup guide for non-experts. Get the exact DMARC record example, add it at Cloudflare, GoDaddy or Namecheap, and roll out from p=none to reject safely. - How to set up DMARC on Google Workspace (step by step)
Set up DMARC for your Google Workspace domain in four steps: verify SPF, enable DKIM in the Admin console, publish the DMARC record, then monitor and tighten to p=reject. - How to set up DMARC on Microsoft 365 (step by step)
Set up DMARC for your Microsoft 365 domain in four steps: verify SPF, enable custom DKIM in the Defender portal, publish the DMARC record, then monitor and tighten to p=reject. - How to set up DMARC on Zoho Mail (step by step)
Set up DMARC for your Zoho Mail domain in four steps: verify SPF, generate a DKIM selector in the Admin Console, publish the DMARC record, then monitor and tighten to p=reject. - How to set up DMARC with Amazon SES (and why SPF alone won't align)
Set up DMARC for a domain sending through Amazon SES: Easy DKIM CNAMEs, the custom MAIL FROM domain that makes SPF align, the DMARC record itself, and how to verify the result. - Mailgun SPF, DKIM and DMARC setup: pass alignment on your own domain
How to set up Mailgun so its mail passes DMARC for your domain: why a mg. subdomain is the right sending domain, the DNS records that actually matter, how alignment works, and the traps that quietly break it. - SPF vs DKIM vs DMARC: The Difference Explained in Plain English
SPF, DKIM and DMARC each solve a different problem. A plain-English explanation of what each one checks, why you need all three, and how alignment ties them together. - SPF ~all vs -all: softfail, fail, and which one to actually use
The last tag of your SPF record looks like a security dial — but receivers don't treat it the way you'd expect. What ~all and -all really do, why -all isn't the upgrade it seems, and the right ending once DMARC is in place. - What is a DKIM selector, and how do I find mine?
A DKIM selector is the label that tells receivers which public key to fetch from your DNS. How to find your selector in message headers, the default selectors per provider, and why domains have several. - DMARC Policy: p=none vs p=quarantine vs p=reject — Which Should You Use?
What p=none, p=quarantine and p=reject actually do, the risks of moving too fast (or never moving), and a safe checklist for tightening your DMARC policy. - DMARC for subdomains: the sp= tag, and the subdomains you forgot about
Subdomains inherit your DMARC policy unless you say otherwise — which is exactly what spoofers count on. How the sp= tag works, when to set sp=reject before p=reject, and how to check reports first. - How to Read DMARC Reports: Aggregate XML Report Example Explained
Learn how to read DMARC reports in plain English. A real DMARC aggregate report example with the XML explained: source_ip, count, disposition, DKIM, SPF, alignment. - DMARC ruf= forensic reports: what they are and why you barely get any
You added ruf= to your DMARC record and almost nothing arrives. That's normal: most large providers don't send forensic (failure) reports. What ruf and fo do, the external-destination rule, and why aggregate reports carry the real signal. - Gmail Bulk Sender Requirements (Google & Yahoo 2026 Checklist)
The full Google, Yahoo and Microsoft bulk sender requirements for 2026: SPF, DKIM, DMARC, aligned From, one-click unsubscribe and spam rate. Checklist, timeline, and how to verify each item today.
Fixing problems
- Why DMARC fails and how to fix it: alignment, forwarding, unsigned senders
dmarc=fail even though SPF and DKIM look configured? The real causes in plain English — alignment, forwarding, provider-domain DKIM signatures — and the fix for each. - DKIM fail: "body hash did not verify" — what it means and how to fix it
The DKIM error 'body hash did not verify' means the message body changed after it was signed. What actually causes it — footers, forwarding, line-ending rewrites — and how to fix each case. - Gmail 550-5.7.26 error: fix "this mail is unauthenticated"
Gmail 550-5.7.26 error: fix "this mail is unauthenticated". Plain-English steps to set SPF, DKIM, and DMARC so Gmail stops rejecting your mail. - Outlook 550 5.7.515 error: fix "sending domain does not meet the required authentication level"
Microsoft bounced your mail with 550 5.7.515 "does not meet the required authentication level". Plain-English steps to set SPF, DKIM, and DMARC so Outlook and Hotmail accept your mail. - Not receiving DMARC reports? The 6 reasons and how to fix each one
Published a DMARC record but no aggregate reports are arriving? The 6 common causes — missing rua, typos, external-destination authorization, low volume — and how to fix each. - SPF PermError: too many DNS lookups — what it means and how to fix it
SPF PermError "too many DNS lookups" means your record exceeds the 10-lookup limit. Plain-English steps to count your lookups, trim includes, and get SPF passing again. - SendGrid, Mailchimp & other platforms failing DMARC? Fix third-party sender alignment
Your newsletter or transactional platform passes SPF and DKIM but still fails DMARC? That's an alignment problem. How to enable domain authentication on SendGrid, Mailchimp, HubSpot and any other third-party sender.
For agencies, agents, and tool shoppers
- DMARC Monitoring for Agencies: Managing Client Domains Without the Busywork
How agencies monitor DMARC across many client domains: why it becomes your problem, what breaks at 10+ domains, and how white-label weekly reports turn it into billable proof of work. - Let your AI agent manage DMARC: full API access with Bearer keys
PlainDMARC is operable end-to-end by an AI agent: free JSON DMARC checks with no key, llms.txt API docs, and per-account Bearer keys that cover domains, verdicts, and white-label client reports. - EasyDMARC, dmarcian & Postmark Alternatives for Agencies (2026)
An honest comparison of EasyDMARC, dmarcian, Postmark DMARC Digests and DMARCReport alternatives for freelancers and agencies managing many client domains — pricing, best-for, and a worked cost example. - dmarcian Alternative for Agencies: Flat-Price, White-Label DMARC Monitoring (2026)
Looking for a dmarcian alternative? An honest comparison for freelancers and agencies managing client domains: where dmarcian is the right choice, where a flat-price white-label tool like PlainDMARC fits better, and how to decide. As of July 2026. - EasyDMARC Alternative for Agencies: Flat-Price, White-Label DMARC Monitoring (2026)
Looking for an EasyDMARC alternative? An honest comparison for freelancers and agencies managing client domains: where EasyDMARC is the right choice, where a flat-price white-label tool like PlainDMARC fits better, and how to decide. As of July 2026.
Check your own domain
Reading is optional — you can just run a free check on your domain and get a plain-English verdict right now, no signup needed.