Question 1

What is a DMARC record and why do I need one?

Accepted Answer

A DMARC (Domain-based Message Authentication, Reporting and Conformance) record is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF or DKIM checks — and where to send aggregate reports. DMARC protects your domain from being spoofed in phishing and business-email-compromise attacks, and gives you visibility into who is sending mail using your domain.

Question 2

Should I start with p=none or p=quarantine?

Accepted Answer

Always start with p=none (monitoring mode). With p=none, receiving servers take no enforcement action — they just send you reports. Use the reports for 2-4 weeks to verify all legitimate senders (mailing lists, transactional services, your own mail server) pass SPF and DKIM. Once you have a clean baseline, move to p=quarantine (send failing mail to spam), then eventually to p=reject (block failing mail outright). Jumping straight to reject will cause legitimate email to be lost.

Question 3

How do I add a DMARC record to my DNS?

Accepted Answer

Log into your DNS provider (Cloudflare, Route 53, GoDaddy, Namecheap, etc.). Create a new TXT record. The host/name is _dmarc (your provider will append your domain automatically, so the full DNS name becomes _dmarc.yourdomain.com). The value is the record string generated by this tool, in quotes if your provider requires it. TTL can be 3600 (1 hour) to start. Wait 15-60 minutes for propagation, then verify with dig TXT _dmarc.yourdomain.com or nslookup.

Question 4

What is the difference between SPF and DKIM?

Accepted Answer

SPF (Sender Policy Framework) validates the envelope sender's IP against a list of authorized IPs published in your DNS. It fails when the sending IP is not on your list. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message that the receiver verifies against a public key published in your DNS at selector._domainkey.yourdomain.com. DMARC ties them together: a message passes DMARC only if it passes SPF or DKIM, AND the authenticated domain (the SPF domain or the d= domain in DKIM) aligns with the visible From: domain.

Question 5

What is rua and what is a DMARC reporting URI?

Accepted Answer

rua is the URI where you want to receive aggregate (rua) reports. The URI must be an HTTPS endpoint or a mailto: address that accepts DMARC XML reports. Many providers offer free rua endpoints: Postmark, Valimail, Dmarcian, Proofpoint. Without rua you get zero visibility into who is sending mail using your domain — start with monitoring mode and a rua endpoint.

🛡️ DMARC TXT Record

📧 SPF TXT Record

🔐 DKIM TXT Record

📚 Quick Reference