What is DMARC?
DMARC builds on SPF and DKIM. It tells receiving mail servers what to do with mail that claims to be from your domain but fails those checks — let it through, put it in spam, or reject it — and asks them to send you reports about all mail using your domain. Gmail and Yahoo now require a DMARC record from anyone sending email in bulk.
Roll it out in three steps
- Start with p=none and a report address. Nothing is blocked; you receive daily reports showing every server sending mail as your domain.
- Fix what the reports show: add missing services to SPF and turn on DKIM signing with each provider.
- Tighten the policy to quarantine, then reject, once your real mail passes. Use pct to apply it to part of the mail first if you are cautious.
How to add the record
In your DNS settings, add a TXT record whose host (name) is _dmarc — your DNS panel adds your domain after it — and paste the value. Only one DMARC record is allowed per domain.
Reading the reports
Aggregate reports arrive as zipped XML files that are hard to read by hand. A free DMARC report service can collect and chart them; if its address is on another domain, it publishes the authorisation record that allows reports to be sent there.
Frequently asked questions
What DMARC policy should I start with?
p=none with a rua report address. It changes nothing for delivery but shows you who sends mail as your domain.
Does DMARC need SPF and DKIM?
Yes. Mail passes DMARC when SPF or DKIM passes and matches the From domain. Set both up for the best results.
Why are reports not arriving?
Check the record with the Email DNS Checker. If reports go to another domain, that domain must authorise them, and reports only arrive once providers have received mail from you.