What DMARC is
DMARC is a TXT record that tells receiving mail servers what to do with a message that claims to be from your domain but fails both SPF and DKIM. It also asks them to send you reports.
It is always stored on the name _dmarc under your domain. This tool adds that part for you.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"The tags in a DMARC record
| Tag | Meaning |
|---|---|
v=DMARC1 | Marks the record as DMARC. It must come first. |
p=none | Deliver failing mail anyway. You only collect reports. |
p=quarantine | Send failing mail to the spam folder. |
p=reject | Refuse failing mail. |
rua=mailto: | Where daily summary reports are sent. |
sp= | A separate policy for subdomains. |
pct= | The share of failing mail the policy applies to. 100 if absent. |
adkim= / aspf= | How closely the DKIM and SPF domains must match the From domain: r relaxed or s strict. |
How to roll DMARC out safely
- Publish
v=DMARC1; p=none; rua=mailto:[email protected]. Nothing is blocked yet. - Read the reports for two to four weeks. They list every server that sends mail as your domain.
- Fix SPF and DKIM for each real sender you find, such as your newsletter tool and your invoicing system.
- Move to
p=quarantine, watch the reports again, then move top=reject.
Skipping straight to reject is how real invoices and password resets get lost.