Email security

How to fix: DMARC record

DMARC is a DNS TXT record that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment, and where to send reports about them.

Not sure whether your site has this problem? Check it in seconds.

Email Security checker Run a free audit

Why it matters

DMARC is what actually stops someone sending email that appears to be from your domain. It also gives you reports showing who is sending mail as you. Major mailbox providers increasingly expect it from bulk senders.

How to check

Look up the TXT record at _dmarc.yourdomain.com. It should start with v=DMARC1.

How to fix it

Step 1: monitor

Type: TXT   Name: _dmarc   Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Step 2: quarantine

Type: TXT   Name: _dmarc   Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

Step 3: reject

Type: TXT   Name: _dmarc   Value: v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com

Common mistakes

Jumping straight to p=reject: legitimate mail from a service you forgot about gets rejected. Stay on p=none until the reports show only mail you recognise, then step up.
Publishing DMARC without working SPF or DKIM: DMARC passes only if at least one of them passes and aligns with your From domain.
Pointing rua at a mailbox that can't handle the volume of XML reports; consider a DMARC reporting service.

Frequently asked questions

How long should I stay on p=none?

Long enough to see reports from all your normal sending sources, commonly a few weeks. There's no fixed rule.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.