DMARC Record: How to Add One the Right Way

What Is a DMARC Record?

Gmail and Yahoo now expect a DMARC record from anyone who sends a lot of mail. Without one, your mail can bounce or land in spam. A DMARC record is a TXT record in your DNS that tells receivers what to do when a message fails SPF and DKIM.

DMARC also checks something SPF alone does not: that the domain people see in the From line matches the domain that passed SPF or DKIM. As a result, it stops strangers from sending mail that looks like it comes from you.

How to Read a DMARC Record

A good first record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

• v=DMARC1 marks the record as DMARC.
• p=none only watches. Receivers deliver mail as before, but you get reports.
• p=quarantine sends failing mail to spam.
• p=reject refuses failing mail completely.
• rua= is the address that receives the daily summary reports.

So start with p=none. It changes nothing for delivery, yet it shows you every server that sends mail as your domain.

How to Add a DMARC Record

First, make sure SPF is in place, because DMARC builds on it. Then build the record with our free DMARC and SPF Generator. Choose the policy none and enter an address for the reports.

Next, add a TXT record in your DNS panel. The most common mistake is the name. It must be _dmarc, not @. At @, no receiver ever looks for it.

Finally, look it up to check it is live:

nslookup -type=txt _dmarc.example.com

You can also see it in our DNS Records Checker.

Reading the DMARC Reports

After a day or two, receivers such as Google and Microsoft start sending reports to the rua address. Each one is a small XML file that lists the servers that sent mail as your domain and whether they passed SPF and DKIM.

Look for real services that fail, such as a newsletter tool or a helpdesk. Fix those first, usually by adding them to SPF or setting up DKIM. Meanwhile, unknown servers that fail are often spoofers, and those are exactly what DMARC will block later.

From p=none to p=reject

Once your real services all pass, tighten the policy in steps. Therefore, do not jump straight to reject:

1. p=none for two to four weeks while you read the reports.
2. p=quarantine; pct=25 to send a quarter of failing mail to spam.
3. p=quarantine for all failing mail.
4. p=reject once the reports stay clean.

In short, every step is a small change you can undo the same day if something breaks.

What DMARC Alignment Means

DMARC does not just ask whether SPF or DKIM passed. It also asks whether they passed for the same domain the reader sees in the From line. People call this match alignment.

SPF alignment

SPF checks the hidden return address, not the From line. So if a newsletter tool sends with its own return address, SPF can pass while alignment fails. Many tools let you set a custom return domain to fix this.

DKIM alignment

DKIM aligns when the signing domain, the d= value, matches your From domain. Therefore, set up DKIM with your own domain in every service that sends for you, not the service's default domain.

Relaxed and strict

By default, alignment is relaxed: mail.example.com counts as a match for example.com. Strict mode needs an exact match. Most sites should keep the default.

Other DMARC Tags Worth Knowing

Most records only need v, p and rua. Still, a few more tags are useful once the basics work.

• sp= sets a separate policy for subdomains.
• pct= applies the policy to only part of the failing mail, for example 25 percent.
• ruf= asks for forensic reports on single failures; many receivers no longer send them.
• adkim= and aspf= switch DKIM or SPF alignment between relaxed (r) and strict (s).

In short, add a tag only when you know why you need it. Every extra tag is one more thing that can be wrong.

DMARC for Subdomains and Parked Domains

A record on your main domain also covers its subdomains, unless a subdomain has its own record. So one record at _dmarc.example.com is usually enough.

Domains that never send mail are an easy target for spoofers. For those, publish a strict policy straight away, together with an SPF record that allows nothing:

v=DMARC1; p=reject;

Because no real mail comes from a parked domain, DMARC cannot block anything good. Meanwhile, receivers refuse fake mail that uses its name.

Common Mistakes

• Putting the record at @ instead of _dmarc.
• Starting with p=reject, so a forgotten service loses all its mail.
• Adding DMARC before SPF or DKIM works.
• Using a report address on another domain without the extra permission record that domain needs.
• Never reading the reports, so the policy stays at none for good.

In short: name _dmarc, start at none, read the reports, then tighten. For more detail, see Google's DMARC setup guide.

Questions and Answers