DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email policy that builds on SPF and DKIM to tell receiving servers what to do with messages that fail authentication. In simple terms, SPF and DKIM prove your mail is genuine, and DMARC decides what happens to mail that pretends to be you. Setting it up protects your brand and improves the chance your real emails reach the inbox.
Why DMARC matters #
Without DMARC, even if you have SPF and DKIM, receiving servers have no instruction on how to handle forged messages, and they each decide for themselves. DMARC closes that gap. It also sends you reports showing who is sending email using your domain, which is invaluable for spotting abuse. The main benefits are:
- Anti-spoofing: stops criminals from convincingly impersonating your domain.
- Deliverability: a clear, aligned policy builds trust with mailbox providers.
- Visibility: reports reveal every source sending as your domain.
How DMARC works #
DMARC is published as a TXT record on a special hostname, _dmarc.yourdomain.com. It states a policy and where to send reports. The policy can be one of three levels, and it is best to move through them gradually as you gain confidence.
- p=none: monitor only, take no action. Start here to gather reports.
- p=quarantine: send failing mail to spam.
- p=reject: block failing mail outright. The strongest protection.
How to set up DMARC #
- First make sure SPF and DKIM are already configured and passing.
- Log in to your DNS manager or control panel.
- Create a TXT record with the host _dmarc.
- Enter a starting value such as v=DMARC1; p=none; rua=mailto:[email protected].
- Save and allow time for propagation.
Begin with p=none, review the reports for a couple of weeks to confirm all your legitimate senders pass, then tighten the policy to quarantine and eventually reject.
Reading the reports #
The rua address receives daily aggregate reports in XML. These can be hard to read by eye, so many people use a free DMARC report viewer to make sense of them. The goal is to confirm that every source sending on your behalf is authenticated before you enforce a stricter policy.
Troubleshooting #
- Legitimate mail being quarantined: move back to p=none and confirm SPF and DKIM pass for that sender.
- No reports arriving: check the rua address is valid and the record is correct.
- Record not recognised: confirm the host is exactly _dmarc.
Need help? #
DMARC rewards a careful, staged rollout. If you would like a hand interpreting reports or choosing a policy, our support team is available on live chat.
