← Back to Learning Hub

Email Delivery • Beginner • 11 min read

How to Create a DMARC Record (Step-by-Step)

Learn how to create a DMARC record with the right policy, alignment, and reporting tags so you can prevent spoofing, reduce phishing risk, and improve email deliverability.

If you need a practical answer fast: create a TXT record at _dmarc.yourdomain.com with a valid DMARC policy (p=none, p=quarantine, or p=reject) and reporting addresses (rua, optionally ruf). Then verify propagation globally before tightening enforcement.

What is a DMARC record?

A DMARC record is a DNS policy that tells receiving mail servers what to do when messages fail SPF or DKIM checks. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the enforcement layer that sits on top of SPF and DKIM.

In plain language, DMARC decides whether failing mail should:

  • be monitored only (p=none)
  • be routed to spam/junk (p=quarantine)
  • be blocked completely (p=reject)

Why DMARC matters for security and deliverability

Without DMARC, attackers can spoof your domain more easily in phishing campaigns. With DMARC, mailbox providers like Gmail, Microsoft, Yahoo, AOL, and iCloud receive explicit handling instructions for unauthenticated mail.

Benefits include:

  • Reduced spoofing and phishing abuse
  • Visibility into senders using your domain
  • Better sender trust with major inbox providers
  • Improved long-term deliverability when policies are tuned correctly

DMARC policies explained

p=none (monitoring mode)

Use this first. Messages still deliver normally, but aggregate reports are collected so you can validate real traffic safely.

p=quarantine (soft enforcement)

Failing messages are usually sent to spam or junk. This is a safe midpoint after you confirm legitimate senders are aligned.

p=reject (full enforcement)

Failing messages are blocked at SMTP time. Use this only after SPF, DKIM, and alignment are consistently passing.

How to create a DMARC record (step-by-step)

1) Open DNS management for your domain

Sign in to your DNS host (registrar, DNS provider, or hosting control panel).

2) Add a TXT record

  • Host/Name: _dmarc
  • Type: TXT
  • TTL: default (or 300 while testing)

3) Paste a DMARC value

Start with monitoring:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

4) Save and wait for DNS propagation

Most changes appear within a few hours, but full resolver propagation can take up to 24 hours depending on TTL and caching.

5) Verify from multiple locations

Check _dmarc.yourdomain.com with global DNS lookups before changing policy strength.

DMARC record examples you can use

Monitoring only

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

Quarantine policy

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com

Reject policy

v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com

Example with forensic reporting

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; ruf=mailto:forensics@yourdomain.com; fo=1

RUA and RUF: what reporting tags do

rua (aggregate reports)

Sends summarized daily XML reports showing pass/fail trends, source IPs, and alignment outcomes.

ruf (forensic/failure reports)

Sends near-real-time failure samples where supported. Use carefully because data can be sensitive.

How DMARC passes (and why it can fail)

A message passes DMARC when:

  1. SPF or DKIM passes, and
  2. The authenticated domain aligns with the visible From: domain.

Common failure pattern: SPF passes for a third-party envelope sender, but alignment fails because the domain does not match your From: address.

Common DMARC mistakes checklist

  • No DMARC record published at all
  • Invalid TXT syntax (missing semicolons, bad spacing, typos)
  • Missing or undeliverable rua / ruf mailbox
  • SPF or DKIM not configured for all senders
  • Alignment not tested before moving to enforcement
  • Switching directly to p=reject too early
  • Ignoring reports after deployment

Recommended rollout plan

  1. Publish p=none and monitor reports for 1–2 weeks.
  2. Fix SPF/DKIM/alignment for all legitimate platforms.
  3. Move to p=quarantine and monitor impact.
  4. Move to p=reject when failures are understood and acceptable.

Practical verification commands

dig +short TXT _dmarc.example.com
nslookup -type=TXT _dmarc.example.com

Related resources

Frequently asked questions

How long does DMARC take to start working?

Many resolvers pick up the new TXT record quickly, but global consistency may still take up to 24 hours (or longer if previous TTL values were high).

Should I start with p=reject?

Usually no. Start with p=none, validate legitimate traffic, then increase enforcement gradually.

Why is DMARC failing when SPF passes?

Most often because SPF passed for a non-aligned domain. DMARC still fails if alignment with your visible From: domain is not satisfied.

How do I check DMARC propagation globally?

Query authoritative and public resolvers from multiple regions and compare returned TXT values before assuming enforcement is active everywhere.

Troubleshooting box

If results look inconsistent, compare authoritative nameservers first, then recursive resolvers by region. Capture snapshots every 10 minutes for deterministic incident timelines.

Try VallaDNS free →