How to Create a DMARC Record

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email security protocol that helps protect your domain from email spoofing, phishing, and other email-based threats. Implementing a DMARC record ensures that emails sent from your domain are authenticated using SPF and DKIM.

Step 1: Understand DMARC Policy Components

A DMARC record consists of the following key components:

• Policy (p=): Defines how email failures are handled.

  • none – Only monitor email traffic.

  • quarantine – Send suspicious emails to spam.

  • reject – Block unauthenticated emails.

• SPF & DKIM Alignment: Ensures SPF and DKIM authentication matches the domain.

• Reporting Addresses (rua & ruf): Specifies where aggregate (rua) and forensic (ruf) reports should be sent.

Step 2: Create a DMARC Record

A DMARC record is a TXT record added to your domain’s DNS settings.

Example DMARC Record:

_dmarc.example.com.  IN TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=reject; aspf=s; adkim=s; pct=100"

Explanation:

• v=DMARC1 – Specifies DMARC version.

• p=reject – Enforces strict DMARC policy (adjust based on needs).

• rua=mailto:[email protected] – Aggregate reports sent here.

• ruf=mailto:[email protected] – Forensic reports sent here.

• sp=reject – Applies the same policy to subdomains.

• aspf=s – Strict SPF alignment.

• adkim=s – Strict DKIM alignment.

• pct=100 – Applies policy to 100% of email traffic.

Step 3: Add the DMARC Record to Your DNS

1. Log in to your DNS provider’s control panel.

2. Navigate to the DNS settings (Manage DNS, Advanced DNS, or similar).

3. Create a new TXT record with:

   • Host: _dmarc (e.g., _dmarc.example.com)

   • Type: TXT

   • Value: Paste your DMARC record.

   • TTL: 1 hour (or default setting).

4. Save the record and wait for propagation (up to 48 hours).

Step 4: Monitor and Adjust Your DMARC Policy

Once your DMARC record is active:

• Check DMARC reports regularly.

• Start with p=none to monitor before enforcing stricter policies.

• Gradually move to quarantine or reject to improve email security.

FAQs

How long does it take for DMARC to take effect?

It can take 24-48 hours for DNS propagation.

What happens if I use p=reject immediately?

Emails failing DMARC authentication will be blocked. Start with p=none to monitor first.

Do I need SPF and DKIM before setting up DMARC?

Yes, SPF and DKIM should be configured first for DMARC to work properly.

How can I check if my DMARC record is working?

Use tools like MXToolbox, DMARC Analyzer, or check reports from your specified email address.

Setting up a DMARC record helps protect your domain from phishing and spoofing attacks. By implementing DMARC gradually and monitoring reports, you can ensure a secure and authenticated email system.