Set up SPF, DKIM & DMARC for your provider.

One rule that applies to every provider

Whichever platform you use, publishing the record is only half the job: reports have to reach somewhere you can read them. If the mailbox in your rua= is on a different domain from the one publishing the record — an analyzer you run, or your agency's inbox — that domain has to authorise it with a record of its own:

clientdomain.com._report._dmarc.agency.com   TXT   "v=DMARC1"

Without it, conforming receivers silently discard the reporting request. Nothing bounces, the record still validates, and the reports simply never arrive — see reports won't arrive if rua= is wrong for the full treatment, or check a live domain with the record checker, which verifies external destinations for you.

One more thing every provider shares: publishing a record in the control panel is instant, but DNS catching up is not. A resolver caches what it already has for the record's TTL, so a checker showing the old value right after you save is usually just cache, not a mistake — it can take anywhere from a few minutes to 48 hours to be visible everywhere. Query Google's resolver directly if you want the least-cached answer available, rather than waiting out the TTL blind.

And unlike SPF and DKIM, which need touching for every service that sends on your behalf, the DMARC record itself doesn't care how many providers you use. One mailbox or ten marketing platforms sending under your domain, you still publish exactly one record at _dmarc.yourdomain.com. What changes per sender is whether SPF and DKIM pass for them — DMARC just reads the result.