DMARC Record

  • Record

    • What is a DMARC Record?

    A DMARC record defines the DMARC record rulesets and can be considered as the essence of a DMARC implementation. DMARC records notify email receivers if a domain is configured for DMARC. If this is the case, the DMARC record consists of the policy configured by the domain owner. Additionally, a DMARC records a DNS (Domain Name Service) entry. You need to implement a DMARC DNS record to be able to use DMARC. This DMARC record will be used by email receivers that have DMARC configured in their emailing system. This will result in the tracking of all emails sent to the organization’s domain, taking into account the DMARC policy of that particular organization. Since the DMARC records are stored in the DNS, it makes them instantly accessible to any mail server on the Internet. As long as it has access to DNS, a system can retrieve the DMARC record for any domain and use it to determine whether an email is authentic or not. This will allow organizations issuing DMARC records to indicate how violations should be handled. These messages can be monitored (and delivered), trashed, or rejected.

    What is a DMARC Record
  • Create

    • How to create a DMARC record?

    The DMARC record should be placed in the DNS of your domain. The TXT record name should be “_dmarc.yourdomain.com” where “yourdomain.com” is replaced with your actual domain name. Using a DMARC Generator, EmailAuth helps to easily generate the DMARC record of any domain. Users are allowed to use the DMARC generator to generate a sample DMARC record.
    DKIM and SPF must be configured before deploying DMARC. DKIM and SPF should be validating email messages for at least 48 hours before DMARC is turned on. Once everything is in place, follow these steps to create a DMARC record:

    Note: Perform these steps in the management console for your domain host.

    1. Be ready with the text file or line that consists of your DMARC policy record.

    2. Sign in to the management console for your domain host.

    3. Find the page where you updated your DNS records.

    4. Add your DNS TXT record, or update an existing record, by inserting your record in the TXT record for  _dmarc.

      4.1. In the first field, under the DNS Hostname, enter _dmarc.yourdomain.com. Note that some domain hosts automatically add the domain name after _dmarc. After you add the TXT record, verify the DMARC TXT record name for its correct formatting.

      4.2. In the second field, enter the text for your DMARC record. For example:
      v=DMARC1;p=none;rua=mailto:dmarc-reports@emailauth.io

    5. Save your changes.

    Sample DMARC Record

    The DMARC record is in the form of a line of plain text. The text consists of a list of DMARC tags and values separated by semicolons. Some tags are mandatory and some are optional. A DMARC policy instructs the receiving servers on what action to take on messages that fail the authentication. The action to be taken is defined by the policy (p) tag when you define your DMARC record. Refer to the following example of a DMARC policy record. The v and p tags must be listed first, other tags can be placed in any order.

    v=DMARC1; p=reject; rua=mailto:dmarc-reports@emailauth.io

    Common tags used in DMARC TXT records

    The following table displays the common tags used in DMARC TXT records, along with their status, description, and values:

    TagRequired/OptionalDescription
    vRequiredThe Version (v) tag of DMARC provides DNS records as DMARC records for the receiving mail server and must exactly match the value of DMARC1. If the value of this tag is missing or not exactly DMARC1, then the record is not a DMARC record. In addition, this tag must be the first value in the list.
    pRequiredThe required p-tag demonstrates the domain policy. It instructs the recipient to report, quarantine, or reject emails that fail authentication verification. The policy options are: None, Quarantine, or Reject.
    pctOptionalThis tag specifies the percentage of unauthenticated messages that are subject to the DMARC policy. As you gradually implement DMARC, you can start with a small set of messages. As more messages from your domain pass the receiving server authentication, update your log with a higher percentage until it reaches 100%.
    ruaOptionalThis optional tag is designed to receive reports about DMARC activity for your domain. A rua example is rua=mailto:report@for.example.com.
    rufNot supportedThis tag is not supported by Gmail. It is used to send failure reports. Failure reports are also called forensic reports.
    spOptionalThis tag defines the policy for subdomains.
    aspfOptionalThe aspf tag represents alignment mode for SPF. It sets the alignment policy for SPF, which specifies how strictly message information must match SPF signatures.
    adkimOptionalLike aspf, the optional adkim tag is the alignment mode for the DKIM protocol.

    Ready to get started?

    Request demo