DMARC is an email authentication protocol. DMARC protects your domain from being misused by scammers. With DMARC, you can stop people from sending emails that pretend to come from your domain, which cuts down on phishing and spoofing. In this article, we’ll cover why DMARC matters and how to set up DMARC to secure your emails.
What Is DMARC?
DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance, is a protocol designed to authenticate and protect email domains from unauthorized use, such as spoofing, phishing, and scams.
DMARC builds on two older authentication methods, SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), to check that emails really come from you. The current standard is RFC 9989, published by the IETF (Internet Engineering Task Force) in 2026. DMARC checks the alignment of the “From” field with other authenticated domains and specifies how to handle emails that fail authentication tests.
Without DMARC, your domain is easier for attackers to exploit. Attackers can send fraudulent emails that seem legitimate, tricking recipients into sharing sensitive information or clicking on malicious links.
When you set up DMARC, you decide how receiving servers handle emails that fail the checks. A working DMARC record protects both your business and your customers.
How do you set up DMARC?
Set up SPF and DKIM first, then add a DMARC TXT record at _dmarc.yourdomain.com that starts with p=none, read the reports, and tighten the policy to quarantine and then reject.
SPF and DKIM come first. Google’s guide to setting up DMARC says you must turn on SPF and/or DKIM before you can use DMARC, and that SPF and DKIM should be authenticating your messages for at least 48 hours before you turn DMARC on. Once SPF and DKIM are working, follow the steps below to prepare your record, add the record to your DNS (Domain Name System) settings, and monitor and adjust your policy.
Step 1: Prepare Your DMARC Record
Before you can set up DMARC, you need to create a DMARC record. A DMARC record is a short line of text that you publish in your DNS settings. The record tells receiving mail servers how to handle emails from your domain that fail authentication checks.
To create your DMARC record, you will need to define the following:
- Policy (p tag): Decide how you want to handle emails that fail DMARC checks. You have three options:
- None: Receiving servers handle failing emails as usual and send you reports. Start here.
- Quarantine: Receiving servers treat failing emails as suspicious, which usually means the spam folder.
- Reject: Receiving servers refuse failing emails completely.
- Aggregate Reports (rua tag): Specify an email address to receive reports on how your domain’s emails are being handled. Use the format: mailto:your-email@example.com.
- Percentage (pct tag), optional: Older guides suggest applying your policy to a small percentage of emails first. The newest DMARC standard, RFC 9989, removes the pct tag, so receiving servers may ignore pct. Starting at p=none is the simpler way to test your setup.
A DMARC record consists of plain text with various tags and values, separated by semicolons. The v (version) tag is required and must come first, followed by the p (policy) tag. Other tags like rua (for reporting) and sp (for subdomains) are optional but can be included based on your requirements.
Your first DMARC record should look something like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;
Google recommends setting the policy to none when you start with DMARC, then changing it to quarantine or reject over time.
Make sure to replace example.com with your actual domain.
Some domain hosts might automatically append your domain name to the TXT record name, potentially causing incorrect formatting. After adding your DMARC TXT record, verify the format using tools like the Google Admin Toolbox’s Dig feature. Ensure the TXT record is correctly formatted to reflect the intended DMARC policy.
Step 2: Update Your DNS Records
Now that you have your DMARC record, you need to add it to your domain’s DNS settings. You add the record through your domain provider’s management console.
Here’s how:
- Log in to your domain provider’s console.
- Find the page where you can update DNS records.
- Add a new TXT record with the following details:
- Name: _dmarc.yourdomain.com
- Value: Your DMARC record text, like the example above.
- Save your changes.
Make sure your DMARC record is correctly formatted. Some domain providers automatically add the domain name to the end of the TXT record name. Check that your record is accurate.
Step 3: Monitor and Adjust
After setting up DMARC, monitor the reports sent to your specified email address. The reports show which servers are sending email as your domain and whether those emails pass SPF and DKIM. If a service you use, like your email marketing tool, is failing, fix its SPF or DKIM setup before you tighten the policy. Once the reports show your real emails passing, change p=none to p=quarantine, and later to p=reject. If legitimate emails start landing in spam after a change, step the policy back while you fix the cause.
It is strongly advised not to disable DMARC for your domain. Without DMARC, your domain is vulnerable to email spoofing, phishing, and spam. Turning DMARC off exposes your users and contacts to more risk.
Why does DMARC matter for your business?
DMARC makes it much harder for scammers to send email in your business’s name, and Gmail requires it from anyone who sends more than 5,000 messages a day to Gmail accounts.
Since February 1, 2024, Google’s email sender guidelines have required senders who send more than 5,000 messages a day to Gmail accounts to set up DMARC, with a policy of at least none. Here’s why DMARC matters even if you send far less:
Protection Against Phishing and Spoofing
DMARC protects your business from phishing and spoofing attacks. When you set DMARC to quarantine or reject, receiving servers can flag or block fraudulent emails that use your domain. Blocking those emails protects your brand reputation and your relationship with customers.
Peace of Mind for Your Customers
Your customers also benefit from DMARC. Customers can trust that emails from your domain really come from you, which builds confidence in your brand. DMARC does not encrypt your emails or make them private, but DMARC does make it harder for scammers to fool your customers with fake messages that appear to come from you.
How does diib monitor your DMARC setup?
The diib dashboard has a DMARC widget that checks your record and alerts you if something goes wrong.
On the diib dashboard, you’ll find a widget that monitors your DMARC setup. When no issues are detected, the widget shows that your DMARC record is working as intended.
If the widget shows no issues, your DMARC record is set up correctly. diib keeps checking your DMARC setup and alerts you if a problem shows up, so you can fix the problem quickly.
Automatic monitoring saves you time, because you don’t have to check by hand that your DMARC record is still in place and working.
How can diib help you keep DMARC working?
diib watches your DMARC record from your dashboard, so you find out quickly if something breaks.
Setting up DMARC helps in protecting your business from email-based threats. When you know how to set up DMARC properly, you make it much harder for scammers to impersonate your brand.
With DMARC in place, your customers can trust that emails from your domain really come from you.
Protect your business and secure your emails with DMARC. Don’t leave your domain vulnerable to attacks. Sign up for diib today to start monitoring your DMARC setup.
With diib, DMARC monitoring sits in the same dashboard as the rest of your website data. For inquiries, feel free to reach out to us.
