4 min read
How to add a DMARC record: step by step
Create and publish a DMARC record in DNS, starting at p=none with reporting, then check that it works. Works with any DNS host.
Before you start
You need access to the DNS for your domain, which is wherever your name servers point, not necessarily where you bought the domain. You also need an address to receive reports. A reporting service gives you one; a personal mailbox will fill up quickly.
Step 1: decide the starting record
Start at p=none. That tells receivers to deliver mail as they do now and send you reports. It cannot block any mail, so it is safe to publish today.
v=DMARC1; p=none; rua=mailto:your-report-address@example.com
Step 2: add the TXT record
In your DNS editor, add a record of type TXT. For the name or host, enter _dmarc. Most hosts add your domain for you, and typing the full name by mistake creates _dmarc.example.com.example.com. Paste the value without quotes unless your host asks for them.
If a _dmarc record already exists, edit it. Two records make both invalid.
Step 3: check it
DNS changes can take from a few minutes to a few hours to be visible. Look the record up with a checker to confirm it is published once and is valid. Reports start arriving within a day or two.
Step 4: what next
Read the reports, fix the legitimate services that fail, and then move to quarantine and reject in steps. Going straight to reject before you know who sends as you is the most common way to block your own mail.