DMARC: Complete Guide to Protect Your Domain (DMARC)

Introduction

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the third piece of email authentication. While SPF and DKIM verify emails, DMARC defines what to do when an email doesn’t pass verification. It also sends you reports about who sends email with your domain.

In this article you’ll see what DMARC is and how to configure it.

What DMARC is

DMARC uses SPF and DKIM to decide what to do with emails claiming to come from your domain but that aren’t legitimate. You define a policy:

• none: does nothing, only sends you reports.
• quarantine: sends suspicious emails to spam.
• reject: rejects suspicious emails (they don’t even reach spam).

DMARC also sends you reports with all emails sent with your domain, legitimate or not. It’s very useful for detecting spoofing.

Before you start

DMARC requires you to have SPF and DKIM configured. If you don’t have them, configure them first:

• SPF guide in our knowledge base.
• DKIM guide in our knowledge base.

If you configure DMARC without SPF or DKIM, all your legitimate emails can go to spam.

How to configure DMARC

DMARC is a DNS record of type TXT with the name _dmarc.yourdomain.com.

none policy (to start)

Always start with none to receive reports without affecting email:

v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com

• v=DMARC1: DMARC version.
• p=none: policy (does nothing, only reports).
• rua=mailto:...: address to receive reports.

quarantine policy (after a few weeks)

When you see in reports that all your legitimate emails pass SPF and DKIM, upgrade to quarantine:

v=DMARC1; p=quarantine; rua=mailto:postmaster@yourdomain.com

Suspicious emails go to spam.

reject policy (maximum protection)

When you’re sure all your legitimate email passes verifications:

v=DMARC1; p=reject; rua=mailto:postmaster@yourdomain.com

Suspicious emails are rejected directly. It’s maximum protection.

Don’t go to reject without having been in none or quarantine before. If some legitimate service doesn’t pass SPF/DKIM, you’d lose their emails.

How to add DMARC to DNS

1. Log in to cPanel → Zone Editor or your domain’s DNS editor.
2. Add a TXT record:
   • Name: _dmarc.yourdomain.com.
   • Type: TXT.
   • Value: v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com
3. Save.

DNS changes take between minutes and 48 hours to propagate.

How to read DMARC reports

DMARC sends reports in XML format to the address you set in rua. They’re a bit technical, but they tell you:

• Which servers sent email with your domain.
• How many passed SPF/DKIM.
• How many failed.

To read them more easily, use tools like dmarcian or Postmark DMARC.

Reports let you see if someone is spoofing your domain (phishing) and if any legitimate service isn’t passing verifications.

Useful tips

• Start with p=none. It’s the safest to start.
• Review reports for 2-4 weeks. Before upgrading to quarantine or reject.
• Don’t go to reject suddenly. It can block legitimate emails.
• Make sure all your sending services pass SPF and DKIM. Hosting, newsletters, CRM, etc.
• Review DMARC periodically. If you add a new service, check it passes verifications.

Frequently asked questions

Is DMARC mandatory?

Not by law, but Gmail, Outlook and Yahoo require it since 2024 to send bulk email.

Does DMARC cost money?

No, it’s free. It’s a DNS record.

Can I start with reject directly?

Not recommended. If some legitimate service doesn’t pass SPF/DKIM, you lose their emails. Start with none.

What happens if I don’t configure DMARC?

It doesn’t affect your legitimate emails, but you’re not protected against spoofing and Gmail penalizes your deliverability.

Does my miHosting hosting have DMARC?

It doesn’t come by default, but it’s configured in cPanel in five minutes. If you need help, open a ticket.

DMARC: complete protection for your domain

DMARC is the last piece of email authentication. It protects you from phishing, improves your deliverability and gives you visibility over who uses your domain. Configuring it is free and, if you follow the steps (none → quarantine → reject), without risk.

If you need help configuring DMARC on your miHosting domain, open a ticket from your client panel.