p=none, then quarantine, then reject
None only watches. Quarantine sends failing mail to spam. Reject refuses it. Move up one step at a time, when the reports show that only your own services are left failing.
Build your DMARC record.
Choose how strict to be, say where reports go, and get the exact record to add.
Monitoring only. Nothing is blocked. Receivers send you reports of who sends as your domain, so you can fix problems first. Stay here for a few weeks.
Strongly recommended. The reports are what tell you whether it is safe to tighten the policy. Separate several addresses with spaces.
More options
Lets you ease in: start low, and raise it as the reports stay clean.
Few large providers send these, and they can contain parts of messages. Most people leave this blank.
Your DMARC record
v=DMARC1; p=none- Type
TXT- Name
_dmarc(the full name is_dmarc.yourcompany.com)- Value
- the line above, exactly
No reports address is set, so you will not hear about mail that fails. Add one before you rely on this.
DMARC only works when SPF or DKIM passes and matches the domain in your From address. Check yours with the domain checker. Nothing you enter here leaves your browser.
What it means.
Reports come first
A policy without a reports address is flying blind. The reports tell you which senders to fix before you tighten.
SendSend can watch it for you
DMARC monitoring in SendSend reads the reports and lists who sends as your domain, and whether they pass.
Common questions.
What does a DMARC record do?
It tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM, and where to send reports about it. It is the part that protects your domain from being used by someone else.
Where do I put it?
Add a TXT record in your domain’s DNS with the name _dmarc and the value the tool gives you. The full name is _dmarc.yourcompany.com. Many DNS providers add the domain for you, so you only type _dmarc.
Which policy should I choose?
Start with p=none and a reports address. Read the reports for a few weeks to find every service that sends as your domain, fix the ones that fail, then move to quarantine and finally reject. Going straight to reject is how people block their own invoices.
What are the reports?
Daily summaries, in a format meant for machines, from Gmail, Microsoft, Yahoo and others: which servers sent mail as your domain, how many messages, and whether they passed. They are hard to read raw, so use a DMARC monitoring tool to turn them into a list.
What is alignment?
DMARC passes only if SPF or DKIM passes and the domain it checked matches the domain in the From address. Relaxed alignment lets a subdomain match. Strict needs the exact same domain. Relaxed is the default and is right for most people.
Do I need DMARC if I only send a little email?
Gmail and Yahoo require a DMARC record from anyone who sends in bulk, and it helps everyone else too. A p=none record with a reports address costs nothing and shows you who is sending as you.
Does this send my domain anywhere?
No. The record is built in your browser, and nothing is sent to us.
Next: Check your domain · Generate an SPF record · What is DMARC? · Gmail and Yahoo sender requirements
Want to see where every email goes?
SendSend shows what happened to each message you send: delivered, bounced, or marked as spam. Free for 3,000 emails a month.