Skip to content

What is a DMARC record?

By Ash, Founder, HosteazePublished 1 min read

The short answer

A DMARC record is a TXT record at _dmarc.yourdomain.com that tells receiving email servers what to do when a message claiming to be from your domain fails SPF and DKIM checks: deliver it, send it to spam, or reject it. It also asks them to send you reports on who is sending as you.

Combination padlock resting on a laptop keyboard
Credit: TheDigitalWay via Pixabay

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It sits on top of SPF and DKIM: those two check whether an email is genuine, and DMARC says what should happen when it isn't.

What does a DMARC record look like?

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
TagMeaning
v=DMARC1Identifies the record. Must come first.
p=The policy: none (report only), quarantine (send to spam) or reject (block). Must come second.
rua=Where to send daily aggregate reports.
pct=Optional. The percentage of failing messages the policy applies to, from 1 to 100. Useful when tightening the policy gradually.
adkim= / aspf=Optional. s for strict or r for relaxed matching between the From domain and the SPF or DKIM domain. Relaxed is the default.

Which policy should I use?

Start with p=none. It blocks nothing, so it can't break your email, and the reports show you every service sending as your domain. Once all your legitimate senders pass, move to quarantine, then reject. Jumping straight to reject is the most common way businesses accidentally block their own invoices and booking confirmations.

Do I need one?

Yes, if you send email from your own domain. Gmail requires DMARC from anyone sending 5,000 or more emails a day, and having one makes it much harder for scammers to send email pretending to be you.

For the full setup, see how to set up SPF, DKIM and DMARC.

Sources

  1. RFC 7489, DMARC
  2. Google Workspace, Set up DMARC

Keep reading

Traffic light showing a red stop signal under a blue bicycle signalQuestionDMARC p=none vs quarantine vs reject, which should I use?p=none tells receivers to deliver failing email as normal and just send you reports. p=quarantine sends failing email to spam. p=reject blocks it completely. Start at none, read the reports until every service you use passes, then move to quarantine and finally reject. Skipping straight to reject can block your own invoices.Email and domains · 12 October 2026Magnifying glass and pen resting on printed spreadsheets, ready to check the detailsQuestionHow do I check if my domain has DMARC?Look up the TXT record at _dmarc.yourdomain.com. The quickest way is the free Google Admin Toolbox Dig tool. Enter _dmarc followed by your domain, choose TXT, and look for a value starting v=DMARC1. If nothing comes back, your domain has no DMARC record and you should add one.Email and domains · 12 October 2026Open red mailbox with a stream of envelopes flying away from it, like email going astrayQuestionWhy are my emails going to spam?The most common reason is missing or broken email authentication. If your domain has no SPF, DKIM or DMARC records, Gmail and Outlook can't prove the email is really from you. After that come a poor sender reputation, a shared server with a bad history, and messages that look like marketing. Check authentication first.Email and domains · 12 October 2026Hands typing on a keyboard as email envelopes fly outTutorialHow to set up SPF, DKIM and DMARC for your business emailAdd three DNS records in this order. First an SPF record listing who can send email for your domain, then a DKIM record your email provider generates, then, about 48 hours later, a DMARC record starting at p=none. Watch the DMARC reports for a few weeks before tightening the policy to quarantine.Email and domains · 11 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans