DMARC Setup Wizard
Build a safe, staged DMARC rollout plan from p=none to p=reject.
DMARC enforcement done in one jump breaks legitimate mail. The safe way is staged: you start at p=none, which changes nothing about delivery but switches on aggregate reports so you can see every source sending mail as you. Once those reports show your genuine mail is fully aligned, you tighten to p=quarantine on a slowly rising percentage, watch again, then finish at p=reject. This wizard builds that staged plan for your domain, with the exact record to publish at each step, how long to wait, and what to confirm before you advance. Enter a domain and we will detect where you already are and start the plan from there. Everything runs in your browser; nothing you type is stored.
The DMARC Setup Wizard builds a current RFC 9989 rollout from monitoring to enforcement without jumping directly to reject.
Evidence-gated stages
Start at p=none with aggregate reporting and identify every legitimate sender. Then publish p=quarantine; t=y, whose effective policy remains none, before enforcing quarantine. After a clean evidence window, publish p=reject; t=y, whose effective policy is quarantine, before removing test mode for full reject. The legacy pct tag is not generated.
At every gate, SPF or DKIM must pass and align for every legitimate service. Receiver overrides, forwarding and mailing-list traffic need investigation rather than automatic attack classification.
Frequently asked questions
How long should I monitor?
Long enough to observe a full business sending cycle. The report evidence, not a calendar alone, decides when to advance.
What does t=y do?
It applies one policy level lower, making it the current standards-based test step between policy levels.