NeoShield Scan Free

Guide

DMARC setup guide

DMARC tells receiving mail servers what to do with email that claims to come from your domain but fails authentication. Set it up in three stages: publish a monitoring record, fix your senders, then enforce.

Check Your Domain Scan One Authorized Website Free

Only for websites you own or may assess · Passive checks of public pages and DNS · No exploitation, login testing, brute force, fuzzing or load testing

Last updated:

Before you start: SPF and DKIM

  • DMARC passes when a message passes SPF or DKIM and that check is aligned with the domain in the From address.
  • List every service that sends mail as your domain: your mailbox provider, website forms, invoicing, newsletters and support tools.
  • Make sure each one is covered by your SPF record or signs with DKIM for your domain. Most services explain how in their help pages.

Record syntax

DMARC is one TXT record at _dmarc under your domain. Start in monitoring mode:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

v=DMARC1 must come first. p is the policy: none (monitor only), quarantine (treat as suspicious) or reject. rua is where aggregate reports are sent. Optional tags include sp (policy for subdomains) and adkim and aspf (strict or relaxed alignment). Publish only one DMARC record per domain.

Reporting addresses

Aggregate reports arrive as XML files, usually daily, from large mailbox providers. Use a mailbox you can check, or a DMARC reporting service that turns the files into readable charts. If the address is on another domain, that domain must publish a record allowing it, for example:

example.com._report._dmarc.reports.example.net.  TXT  "v=DMARC1"

Moving to enforcement

  1. Publish p=none and collect reports for at least two to four weeks.
  2. Find every legitimate source that fails, and fix its SPF or DKIM alignment.
  3. Change to p=quarantine once legitimate mail passes, and keep watching the reports.
  4. Change to p=reject when you are confident nothing legitimate still fails.
  5. Keep reading reports: a new invoicing or marketing tool can start failing at any time.

Checking the record

Look the record up from a terminal, or use the free domain check, which also reads SPF:

dig +short TXT _dmarc.example.com

Common mistakes: two DMARC records on one domain, the record published at the domain itself instead of _dmarc, a missing mailto: before the report address, and moving to p=reject before every sender passes.

Frequently asked questions

Do I need DMARC if my domain sends little email?

Yes, if you want to make it harder for others to send mail that pretends to be from your domain. A domain that sends no email at all can publish p=reject together with an SPF record of v=spf1 -all.

Will p=reject block my own email?

It can, if a service that sends as your domain is not covered by SPF or DKIM. That is why you start with p=none and read the reports first.

Next steps