Docs

Set up DMARC

Set up DMARC

SPF and DKIM let a receiving server see that a message did not come from you. DMARC tells it what to do about it: deliver anyway, put it in spam, or reject it. It also asks receivers to send you daily reports of who is sending mail as your domain, which is often the first time you learn about a forgotten newsletter tool or someone spoofing your invoices.

Since February 2024 Gmail and Yahoo require a DMARC record from anyone who sends them more than about 5,000 messages a day, and Outlook.com followed in 2025. Smaller senders without one are not blocked outright, but they lose trust points that decide between the inbox and spam.

The site checklist fails this item when there is no DMARC record and warns when the policy is p=none: you are watching, but forged mail is still delivered.

The record

DMARC is one TXT record on the name _dmarc in front of your domain:

Type Name Value TTL
TXT _dmarc (_dmarc.example.com) v=DMARC1; p=none; rua=mailto:dmarc@example.com 3600
Tag Meaning
v=DMARC1 required, must come first
p=none only report, change nothing in delivery
p=quarantine mail that fails goes to spam
p=reject mail that fails is refused
rua=mailto:… where receivers send daily aggregate reports (XML)
pct=25 apply the policy to only 25 % of failing mail; the rest is treated one step softer
sp= a separate policy for subdomains (they inherit p otherwise)

A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the From address. A newsletter tool that sends with its own domain passes SPF for itself, not for you, so it fails DMARC until you set up its DKIM or custom sending domain.

Tip: reports to a mailbox at a different domain (rua=mailto:reports@example.org) only work when that domain publishes a permission record. Report services set this up for you; with your own mailbox, use an address at the same domain.

Check it yourself

Replace example.com with your domain:

dig +short TXT _dmarc.example.com

On Windows:

nslookup -type=TXT _dmarc.example.com

Nothing printed means no record. Fixed means one line starting with "v=DMARC1; and containing p=quarantine or p=reject.

Go from none to reject in steps

Do not start with p=reject. Every service that sends as your domain and is not set up yet (the website's contact form, the accounting software, the CRM, a printer that mails scans) would lose its mail from one day to the next.

  1. Start with p=none and a report address. v=DMARC1; p=none; rua=mailto:dmarc@example.com. Nothing changes in delivery.
  2. Read the reports for two to four weeks. They are XML, one per receiver per day. A free report viewer (several DMARC services have a free tier) turns them into a list of sending sources. For each legitimate source that fails, set up SPF or DKIM for it (Fix SPF, Set up DKIM).
  3. Move to p=quarantine, optionally with pct=25 and then higher. Watch the reports and complaints for another week or two.
  4. Move to p=reject once the reports show only your own sources passing and the failures are forgeries.

The checklist turns OK from step 3 on.

Warning: p=reject before the reports are clean will silently drop real mail: the sender gets a bounce, if anyone reads bounces at all, and you hear about it weeks later from a customer.

How to fix

The record goes where the domain's DNS is hosted, not into the mail system. Google Workspace and Microsoft 365 only tell you what to add. dig +short NS example.com shows the nameservers if you are not sure where DNS is.

Google Workspace

There is no DMARC switch in the Google Admin console: add the TXT record at your DNS host (see its tab).

Type Name Value TTL
TXT _dmarc v=DMARC1; p=none; rua=mailto:dmarc@example.com 3600

Before you tighten the policy, make sure Gmail signs with DKIM for your domain: Apps → Google Workspace → Gmail → Authenticate email, status Authenticating email (see Set up DKIM). Without it, Google's own mail depends on SPF alone.

Microsoft 365

Add the TXT record at your DNS host (see its tab):

Type Name Value TTL
TXT _dmarc v=DMARC1; p=none; rua=mailto:dmarc@example.com 3600

If Microsoft manages the domain's DNS, add it in the Microsoft 365 admin center under Settings → Domains → example.com → DNS records → Add record.

Turn on DKIM for the domain first (Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, see Set up DKIM). Without it, mail forwarded by others often fails DMARC.

cPanel

  1. Open Domains → Zone Editor and click Manage next to the domain.
  2. Check whether a TXT record for _dmarc.example.com. already exists. If it does, edit it instead of adding a second one.
  3. Otherwise Add Record → Add TXT Record: name _dmarc.example.com., record v=DMARC1; p=none; rua=mailto:dmarc@example.com, and Save Record.

Email → Email Deliverability helps with SPF and DKIM, which DMARC builds on. Fix any problems it shows there before you raise the policy.

If the domain's DNS is hosted elsewhere, the Zone Editor changes nothing the world sees: add the record at your DNS host.

Plesk

Plesk's DNS template often already adds v=DMARC1; p=none, which is why the checklist warns rather than fails.

Websites & Domains → example.com → Hosting & DNS → DNS (older versions: DNS Settings). Find the TXT record for _dmarc.example.com., click it, change the value to the policy you want, for example v=DMARC1; p=none; rua=mailto:dmarc@example.com, click OK and apply the changes with Update if Plesk asks.

If there is no such record, Add Record, type TXT, domain name _dmarc, and the same value.

Cloudflare

  1. Open the domain and go to DNS → Records.
  2. Add record: type TXT, name _dmarc, content v=DMARC1; p=none; rua=mailto:dmarc@example.com, TTL Auto, Save.

Cloudflare also offers a free DMARC Management view in the domain's Email section. It adds its own report address to your record and shows the reports as a list of sending sources, which saves you reading XML.

DNS provider

In your registrar's or DNS provider's zone editor, add one TXT record:

Type Name / Host Value TTL
TXT _dmarc v=DMARC1; p=none; rua=mailto:dmarc@example.com 3600

Most providers add the domain to the name themselves, so type _dmarc, not _dmarc.example.com, or you get _dmarc.example.com.example.com. Check with dig afterwards.

If the provider rejects the underscore, it is an outdated editor: ask support to add the record, or move DNS to a provider that handles it.

Confirm the fix

Run the dig command from Check it yourself again, then open the target in PulseKeeper and click Check now on the Checklist tab. The item turns OK within a few minutes once the policy is quarantine or reject; with p=none it stays a warning, as it should while you read the reports.