DMARC Setup Walkthrough for Australian Domains

DMARC is the missing layer in most Australian SMBs' email security. SPF and DKIM are usually configured (badly), but DMARC is published at p=none for years and never enforced. Here's how to get to p=reject without breaking legitimate mail.

Prerequisites

Before DMARC, you need SPF and DKIM working for every service that sends mail on your behalf:

• Microsoft 365 (or Google Workspace)
• Marketing platforms — Mailchimp, ActiveCampaign, HubSpot
• Accounting — Xero, MYOB
• CRM — Salesforce, Pipedrive
• Transactional — Stripe, SendGrid, Postmark, Mailgun
• Helpdesk — Zendesk, Freshdesk

Every one of these needs an SPF inclusion and (ideally) DKIM keys published.

Stage 1 — Monitor (weeks 1–4)

Publish a DMARC record at p=none with rua reporting to a DMARC analytics service (Valimail, Dmarcian, EasyDMARC, Postmark DMARC). Free tiers exist; the visibility is worth more than the cost.

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com; fo=1; adkim=r; aspf=r

For 2–4 weeks, do nothing except read the reports. You'll discover senders you didn't know about — old contractors' apps, that one campaign you ran in 2022, the printer.

Stage 2 — Authenticate everything legitimate (weeks 4–8)

For each legitimate sender showing in your reports, configure SPF and DKIM properly. Decommission anything you don't recognise. The goal: 99%+ of your mail passes DMARC alignment.

Stage 3 — Quarantine (weeks 8–10)

Move to p=quarantine; pct=25. This sends 25% of failing mail to spam. Watch reports for two weeks for any legitimate sender getting caught.

Ramp pct to 50, then 100. If nothing breaks, you're ready for the final step.

Stage 4 — Reject (week 12+)

v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com; fo=1; adkim=s; aspf=s

Now any mail claiming to be from your domain that fails authentication is rejected outright. Your customers stop receiving spoofed emails pretending to be from your CEO.

Common mistakes

• Publishing p=reject without monitoring first — legitimate mail starts bouncing
• Forgetting subdomains (use sp=reject)
• SPF record with more than 10 DNS lookups (use flattening tools)
• BIMI configured without DMARC enforcement — most mailbox providers ignore BIMI unless DMARC is at quarantine or reject