How to set up a DMARC record

DMARC is the record that ties SPF and DKIM together. On their own, each produces a pass or fail result and nothing else — neither tells a receiving server what to actually do about a failure, and neither tells you it happened. A DMARC record answers both: it sets a policy for failing mail, and it gives you visibility into who is sending mail as your domain, including senders you had forgotten about and anyone forging you outright.

What a DMARC record looks like

_dmarc.yourdomain.com   TXT   "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

Step 1: choose a reporting address

Use a mailbox you will actually check, since aggregate reports arrive daily from every major mail provider your domain sends to, and reading them is the entire point of setting DMARC up rather than just leaving SPF and DKIM to run alone. A dedicated address such as dmarc@yourdomain.com is common, so the reports do not mix into a personal inbox.

Step 2: publish the record at p=none

1. Open your DNS settings

   Go to the DNS section of your control panel for the domain.

2. Add a TXT record

   Set the host to _dmarc — this exact prefix is required and is how receiving servers know where to look.

3. Enter the record value

   Use v=DMARC1; p=none; rua=mailto: followed by your reporting address.

4. Save and wait

   The first reports typically start arriving within a day or two, though this varies by which mail providers your domain exchanges mail with.

Step 3: read the reports

Aggregate reports arrive as XML attachments, which is not something most people want to read by hand. A number of free online tools accept these reports and turn them into a readable summary showing every server that sent mail as your domain, and whether it passed or failed SPF and DKIM.

Look specifically for:

• Sources that are clearly you — your hosting mailboxes, your newsletter tool — and confirm they are passing.
• Sources you do not recognise, which need investigating before you tighten the policy any further.
• A sender you do recognise but that is failing, which usually means it needs adding to your SPF record or configuring for DKIM.

Step 4: tighten the policy in stages

1. p=none — monitor only

   Nothing is rejected. This is where you start and where you stay until the reports show a clean, complete picture of your senders.

2. p=quarantine — mail goes to spam

   Once you are confident the reports show all your real senders passing, move failing mail to spam rather than the inbox rather than blocking it outright.

3. p=reject — mail is refused

   The strongest setting, and the one that actually stops someone else's forged mail from being delivered at all. Move here only once you have run at quarantine long enough to be sure nothing legitimate is still failing.

Common mistakes

• Jumping straight to p=reject. Covered above, and worth repeating: this is the single most common cause of legitimate mail silently vanishing after a DMARC record is added.
• No rua= address, or one nobody checks. Without reading the reports, you gain no visibility and the record is only doing half its job.
• Publishing DMARC before SPF and DKIM are stable. A policy based on incomplete authentication data leads to tightening it against a picture that is still wrong.

Once DMARC is live and reporting cleanly, it becomes part of the reason your mail is trusted by the large mailbox providers, several of which now expect authentication in place for bulk senders. It is not, by itself, the whole answer to mail landing in spam — see why your emails go to spam for the reputation and content factors that matter alongside it.