diff --git a/unbound.conf b/unbound.conf
index 35bc6f8..1e6685b 100644
--- a/unbound.conf
+++ b/unbound.conf
@@ -28,6 +28,10 @@ server:
     # AF21
     ip-dscp: 18
 
+# force DMARC enforcement
+local-zone: "_dmarc.gmail.com" static
+local-data: '_dmarc.gmail.com 600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:mailauth-reports@google.com"'
+
 forward-zone:
     name: "."
     forward-tls-upstream: yes