Google Workspace DMARC Enforcement & Reports

Overview: Raise DMARC policy from monitoring to enforcement while ensuring all senders align with SPF/DKIM. Configure RUA/RUF for continuous visibility.

Prerequisites: Admin console access, DNS zone control, verified sending sources inventory.

Steps

1. Inventory all senders (Workspace, marketing platforms, CRM, transactional).
2. Ensure DKIM signing for primary domain and subdomains; verify via DKIM Checker.
3. Publish SPF with required include: entries; validate via SPF Checker.
4. Publish DMARC: start with p=none; rua=mailto:dmarc@yourdomain, then ramp with pct= to quarantine/reject.
5. Optional: set sp= for subdomain policy consistency.

Verification

• Headers: Header Analyzer confirms DKIM selector and alignment.
• DMARC: DMARC Generator and Report Analyzer.

Troubleshooting

• Third-party breaks alignment: add DKIM signing or SPF include, or send from aligned subdomain.
• Reports missing: verify mailbox acceptance and analyzer-specific DNS authorization.

FAQ

Q: Should I enable RUF? A: Use cautiously; failure reports may include message samples.

Related Tools

DMARC Generator DMARC Analyzer Email Health