What is DMARC and how do you set it up?

DMARC tells receiving mail servers what to do with email that pretends to come from your domain but doesn't pass the SPF or DKIM checks. It's the most important measure against phishing in your domain's name.

Check your website now

How DMARC works

An email passes DMARC if SPF or DKIM succeeds and the checked domain matches the sender address the recipient sees. So DMARC builds on SPF and DKIM; make sure those are set up correctly first.

The DMARC record is a TXT record at _dmarc.yourdomain.com.

The policy (p=)

p=none: monitoring only. Email isn't stopped, but you do receive reports.
p=quarantine: email that fails the check goes to the spam folder.
p=reject: email that fails the check is rejected.
Subdomains follow the same policy, unless you specify a different policy for subdomains with sp=.

Rolling out DMARC step by step

Start with p=none and a reporting address (rua). Receivers then send you daily reports about email sent on behalf of your domain. Review them for two to four weeks: once all your own email (website, newsletter, invoices) passes the check, move to p=quarantine and then to p=reject.

TXT record on _dmarc.example.com (start)

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Domain without email

If your domain doesn't send email, you can set the strictest policy right away, together with the SPF record v=spf1 -all.

TXT record on _dmarc.example.com (domain without email)

v=DMARC1; p=reject; adkim=s; aspf=s;

What DMARC doesn't do

DMARC only protects your own domain name. It doesn't stop email from lookalike domains (such as examp1e.com), nor email from a random address that uses your company name as its display name. The policy is also a request: the receiving mail server decides for itself, and passing the check doesn't guarantee that your email lands in the inbox.

Is your policy already on quarantine or reject and legitimate email no longer arrives? Then find out which service isn't set up properly in SPF or DKIM and fix that, instead of setting the policy back to p=none.

Common mistakes

Putting the record on the root domain instead of on _dmarc.
Multiple DMARC records; receivers then ignore all of them.
Staying on p=none for years, so DMARC doesn't stop anything.
Moving to p=reject before every service that sends email on behalf of your domain is set up properly.

How SteadyHost rates DMARC

OK: one DMARC record with p=quarantine or p=reject.
Warning: no DMARC record, or monitoring only with p=none.
Problem: multiple DMARC records, or a record without a valid policy.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.