Setting up DMARC monitoring takes about as long as a coffee refill. You add a domain, prove you own it, change one DNS record, and wait for the mail providers to start reporting in. The waiting is the longest part.

This guide walks through the whole DMARC monitoring setup in MonitorDMARC, from signup to your first reports, plus the handful of things that trip people up. If you’re still on the fence about why you’d monitor DMARC reports at all, start with How to Read DMARC Reports (Without Losing Your Mind) and come back. It makes a pretty good argument for not doing it by hand.

What you’ll need

  • Access to edit DNS for the domain (your registrar, Cloudflare, Route 53, wherever the zone lives)
  • About 10 minutes of hands-on time
  • 24 to 48 hours of patience for the first reports to show up

You don’t need a credit card. The trial is 14 days and covers up to two domains.

Step 1: Create your account

Head to monitordmarc.com and start the free trial. Once you’re in, you’ll land on an empty dashboard waiting for a domain.

Step 2: Add your domain

Add the domain you send email from, for example example.com. If you have a second domain (a brand domain, or an old domain you still own), add it too. The trial includes two.

Pick the domains that matter most first. Parked domains that never send mail are worth protecting too, but your primary sending domain is where the interesting data is.

Step 3: Verify you own the domain

MonitorDMARC needs proof that you control the domain before it will show you reports for it. Otherwise anyone could point a record at us and read your mail flow data.

The dashboard shows you a verification TXT record to add to your domain’s DNS. Copy it exactly as shown, create the TXT record with your DNS provider, and click verify. If verification doesn’t go through right away, give DNS a few minutes to propagate and try again. You can check what the world sees with:

dig +short TXT example.com

If your new verification record shows up in that output, MonitorDMARC can see it too.

Step 4: Point your DMARC reports at MonitorDMARC

This is the step that actually matters. Your DMARC record tells receivers like Google, Microsoft, and Yahoo where to send reports. You’ll update it to send them to MonitorDMARC:

First, see what you have now:

dig +short TXT _dmarc.example.com

If you don’t have a DMARC record yet, create a TXT record at _dmarc.example.com with:

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]

p=none is monitoring mode. It doesn’t change how your mail is delivered, so it’s the safe place to start.

If you already have a DMARC record, don’t create a second one. A domain should have exactly one DMARC record, and two records at _dmarc is a common way to break DMARC entirely. Edit the existing record and change (or add) the rua= and ruf= tags. Keep your current p= policy as it is.

If you want reports to keep going to an existing mailbox or another tool while you try MonitorDMARC, the rua and ruf tags accept a comma-separated list:

v=DMARC1; p=quarantine; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected]

A quick word on RUF (failure) reports

Failure reports are per-message reports sent when a message fails DMARC. They’re useful when you get them, but don’t expect many. Microsoft states plainly that Microsoft 365 doesn’t send DMARC failure reports even when a valid ruf= address is published, and plenty of other providers send few or none because of the privacy concerns around including message details. Add the ruf= tag anyway. It costs nothing, and the providers that do send them will give you useful detail when something fails. Aggregate reports are where most of your visibility will come from.

Step 5: Choose which DNS records to monitor

DMARC reports tell you what happened to mail that was already sent. DNS monitoring tells you when the records that control authentication change, ideally before that change causes a problem.

For each domain, tell MonitorDMARC which records to watch:

  • SPF: your v=spf1 TXT record on the domain
  • DKIM: the selector(s) your mail platforms use. For Google Workspace the default selector is google. For Microsoft 365 it’s selector1 and selector2.
  • DMARC: the _dmarc record you just edited
  • BIMI: if you’ve published a default._bimi record

When any of these change, you’ll get an email alert. That’s handy when someone “cleans up” the SPF record on a Friday afternoon, and when someone you don’t expect is editing your DNS.

Not sure which DKIM selectors you use? Look at the headers of a message sent from each platform and find the s= value in the DKIM-Signature header. That’s the selector.

Step 6: Wait for the first reports

Now for the patience part. Receivers send aggregate reports on their own schedule. Google says its reports are usually sent once a day. Expect your first reports within 24 to 48 hours, assuming your domain sent mail to the big providers during that window.

Once data starts flowing, the dashboard breaks results down by domain, sending source, country, and IP address, so you can see who is sending as your domain and which sources are failing SPF or DKIM.

Troubleshooting: no reports after 48 hours

If the dashboard is still empty after two days, check these in order:

  1. Is the record published correctly? Run dig +short TXT _dmarc.example.com and confirm the rua=mailto:[email protected] address is there and spelled correctly. A missing mailto: is a classic.
  2. Is there exactly one DMARC record? If dig returns two v=DMARC1 strings, delete one.
  3. Did you edit the right zone? If your domain recently moved DNS providers, make sure you edited the one your NS records actually point to (dig +short NS example.com).
  4. Did the domain send any mail? Reports describe mail that receivers saw. A domain that only sends a few messages a week, or never sends to Gmail, Outlook.com, or Yahoo, may not generate reports every day.
  5. Is the domain verified? Reports for unverified domains won’t appear in your dashboard.

What to do once reports arrive

Your first job is to figure out who is sending as your domain and whether each source passes. We wrote a whole guide on that: Who’s Sending Email as Your Domain? How to Find Every Sender. Once every legitimate sender passes, you can start tightening your policy with the DMARC enforcement journey.

Your trial runs for 14 days, which is enough time to collect a solid picture of your mail flow. When it ends, the Starter plan is $19.99/month for two domains, up to 500,000 emails a month, and a year of report history. Need more domains? Professional covers five, and Business covers fifteen.

References