> ## Documentation Index
> Fetch the complete documentation index at: https://help.hoopai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DMARC authentication guide

> Set up DMARC email authentication to protect your sending domain, prevent spoofing, and improve inbox placement.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that tells receiving mail servers what to do when an email fails SPF or DKIM checks. Setting up DMARC protects your domain from spoofing and improves deliverability.

***

## How DMARC works with SPF and DKIM

| Protocol  | What it does                                                 | DMARC requirement                                        |
| --------- | ------------------------------------------------------------ | -------------------------------------------------------- |
| **SPF**   | Verifies the sending IP is authorized for the domain         | SPF-authenticated domain must align with the From domain |
| **DKIM**  | Verifies the email has not been tampered with                | DKIM-signed domain must align with the From domain       |
| **DMARC** | Sets policy for emails that fail both SPF and DKIM alignment | Published as a TXT record on `_dmarc.yourdomain.com`     |

<Note>
  DMARC requires **either** SPF or DKIM to pass **and** align with the From domain. You do not need both to pass, but both configured provides strongest protection.
</Note>

***

## Creating a DMARC record

A DMARC record is a TXT DNS record added to `_dmarc.yourdomain.com`.

### Monitoring mode

```
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
```

### Quarantine mode

```
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.com
```

### Reject mode

```
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensic@yourdomain.com
```

***

## Policy options

<CardGroup cols={3}>
  <Card title="p=none" icon="eye">
    **Monitor only.** No action taken on failing emails. Start here to collect data.
  </Card>

  <Card title="p=quarantine" icon="inbox">
    **Send to spam.** Failing emails go to the spam folder. Good intermediate step.
  </Card>

  <Card title="p=reject" icon="ban">
    **Block entirely.** Failing emails are rejected. Maximum protection.
  </Card>
</CardGroup>

***

## Gradual enforcement path

<Steps>
  <Step title="Start with p=none">
    Publish a DMARC record with `p=none` and an `rua` address. Monitor aggregate reports for 2-4 weeks to identify all legitimate sending sources.
  </Step>

  <Step title="Fix authentication gaps">
    Review aggregate reports. Any legitimate service sending on your behalf must pass SPF or DKIM. Update DNS records as needed.
  </Step>

  <Step title="Move to p=quarantine with low pct">
    Change to `p=quarantine; pct=10`. Monitor for false positives.
  </Step>

  <Step title="Increase pct gradually">
    Raise `pct` from 10% to 25%, then 50%, then 100% over several weeks.
  </Step>

  <Step title="Move to p=reject">
    Once confident all legitimate sources pass, change to `p=reject`. Continue monitoring reports.
  </Step>
</Steps>

***

## Monitoring with aggregate reports

Aggregate reports (`rua`) are XML files showing which IPs sent email using your domain and whether they passed SPF, DKIM, and DMARC. Use a free DMARC report analyzer (DMARC Analyzer, Postmark DMARC, dmarcian) to visualize the data.

***

## Common mistakes

<AccordionGroup>
  <Accordion title="Jumping straight to p=reject">
    Skipping the monitoring phase blocks legitimate emails from services you forgot to authorize. Always start with `p=none`.
  </Accordion>

  <Accordion title="Not including all sending sources in SPF">
    If you send from HoopAI, Google Workspace, and Mailgun, your SPF record must include all three.
  </Accordion>

  <Accordion title="Multiple DMARC records">
    Only one DMARC TXT record per domain. Multiple records cause unpredictable behavior.
  </Accordion>

  <Accordion title="Forgetting subdomain policies">
    The root domain policy applies to subdomains by default. Use the `sp` tag for different subdomain policies.
  </Accordion>

  <Accordion title="Not monitoring after enforcement">
    Continue monitoring even after reaching `p=reject`. New sending sources will fail DMARC if not added to SPF/DKIM.
  </Accordion>
</AccordionGroup>

***

## Connecting DMARC to HoopAI

1. Ensure SPF and DKIM records are configured for your sending domain (see [Email & SMTP setup](/marketing/email-smtp))
2. Add a DMARC record to your root domain's DNS
3. Monitor reports to confirm HoopAI-sent emails pass DMARC alignment
4. Gradually enforce your policy

<Tip>
  Google and Yahoo require DMARC for domains sending more than 5,000 emails per day. Even at lower volumes, DMARC improves deliverability and protects your brand.
</Tip>