DMARC setup in five steps

What DMARC does

DMARC is a TXT record in your DNS at the name _dmarc. It tells mailbox providers what to do with mail that claims to come from your domain but fails authentication, and where to send reports about it.

DMARC builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the checked domain matches the domain in the From address. This is called alignment.

Step 1: check SPF and DKIM

Before adding DMARC, make sure every service that sends as you is allowed by SPF or signs with DKIM: your mailbox, your newsletter tool, your shop, your help desk. Our sender check shows in seconds what your domain has.

Step 2: add a record with p=none

Add a TXT record at your DNS provider:

Name:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]

p=none means block nothing, only report. That is the Gmail and Yahoo minimum and a safe start because no real mail gets lost. The rua address receives daily aggregate reports as XML files.

Step 3: read the reports

Reports show which servers sent as your domain and whether SPF and DKIM passed. The XML is hard to read. Services exist that turn it into tables, or you watch a dedicated mailbox for the first weeks. Look for senders you know that fail, and add them to SPF or set up DKIM for them.

Step 4: tighten the policy

Once all known services pass, move to p=quarantine. Spoofed mail then lands in spam. With pct you can start slowly, for example pct=25 for a quarter of messages. Later move to p=reject so spoofed mail is refused.

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]

Step 5: check now and then

Services come and go. Look at the reports from time to time, especially after you switch newsletter provider.

The Gmail and Yahoo rules

According to Google, senders of more than 5,000 messages a day to Gmail accounts need, among other things:

• SPF and DKIM for the sending domain
• a DMARC record with at least p=none
• alignment between the From domain and SPF or DKIM
• one click unsubscribe per RFC 8058 for marketing mail
• a spam rate below 0.3 % in Postmaster Tools

Yahoo published comparable rules. Even below that volume, these records help you reach the inbox.

Do not forget subdomains

Without the sp tag, the policy of the main domain also applies to subdomains. If you send from a subdomain such as news.yourdomain.com, it needs its own SPF and DKIM records, and the DMARC record of the main domain covers it.

Common mistakes

• Two DMARC records on the same domain. Then neither counts.
• The record sits on the domain itself instead of at _dmarc.
• Jumping straight to p=reject before every service signs correctly. Real mail gets lost.
• A rua address on a different domain without authorisation. Reports never arrive.

In Sendmora you set up DKIM, SPF and the return path with a guided walkthrough for your DNS provider, and we suggest a matching DMARC record.