DMARC Configuring

DMARC Configuring for Domain Protection: Manual Implementation

Step 1: Create a DMARC Record

A DMARC record is a TXT record added to your DNS zone file. Because it is a TXT record, the format is straightforward. When you are starting out, a safe first record looks like this, using a monitoring policy so you can observe before enforcing:

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]

Once your reports confirm your legitimate mail authenticates and aligns, you can raise the policy toward quarantine or reject.

DMARC Record Syntax and Tags Explained

With the publication of RFC 9989 in May 2026, the tag set changed: np, psd, and t were added, and pct, rf, and ri were moved to historic status. Records still containing the historic tags keep working, because receivers ignore tags they do not recognise, but they should be left out of new records.

Active tags:

Historic tags (defined in RFC 7489, removed by RFC 9989, shown for reference only): pct (percentage of mail the policy applied to; its rollout role is now served by t),rf (failure report format; only afrf was ever used),and ri (requested aggregate report interval; receivers used their own schedules).

Step 2: Create a DNS TXT Record

Next, create the DNS TXT record that publishes DMARC:

Navigate to the DNS section of your domain registrar's or DNS provider's site.
Create a new TXT record.
In the Host or Name field, enter _dmarc.
In the Value field, enter the DMARC record you created in Step 1.
Save the record.

Step 3: Validate the DMARC setup

After configuring DMARC, use an online DMARC lookup tool to validate your setup. It will show your record and whether it is correctly formed.

Wait For Your DMARC Record To Propagate

After publishing, you will need to wait for DNS propagation. How long depends on your DNS provider and your record's TTL. This can take up to 48 hours, though many providers (for example Cloudflare) update within minutes. Lowering the TTL on the _dmarc record before making changes can speed up future updates.

Once propagated, verify your settings again with the lookup tool. That completes a basic DMARC configuration.

Things You Need To Know for Optimal DMARC Configuring

1. A DMARC record is not itself a defence mechanism or a signature; it is a published policy. It tells receiving servers how to evaluate mail claiming to come from your domain (by checking SPF and DKIM alignment) and what to do with mail that fails. The protection comes from receivers acting on that policy, which is why enforcement (quarantine or reject) matters.
2. With DMARC correctly set up at enforcement, if someone sends spoofed mail from your domain, the receiving server can reject or quarantine it because the message fails to produce an aligned SPF or DKIM pass.
3. To set up DMARC, you publish the _dmarc TXT record, optionally pointing rua (and ruf) at addresses where receivers send reports on messages that fail authentication. The p tag in the same record tells receivers how to handle failing mail, for example routing it to junk (quarantine) or blocking it (reject).
4. For DMARC to work, you need at least one of SPF and DKIM set up and aligned, though configuring both is strongly recommended for resilience (for example, DKIM survives forwarding when SPF does not). SPF authorises the sending sources for your domain, and DKIM adds a cryptographic signature verifying the message was not altered in transit.
5. Several online tools let you check your DMARC record by entering your domain and running a lookup, so you can confirm your settings.