Anmelden

Creating and publishing a DMARC record in DNS

Build the DMARC record as a TXT entry under _dmarc, understand all tags from p through rua and ruf to pct and start safely with p=none.

A DMARC record is a single TXT entry in DNS. It defines how recipient servers deal with unauthenticated messages and which address the reports go to. Valid SPF and DKIM records are the precondition.

Structure of the TXT record

The record is published under the host name _dmarc.your-domain.com as a TXT entry. A minimal, valid record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com; pct=100

Only a single DMARC record per domain is valid. Several TXT entries under _dmarc make the evaluation invalid under RFC 7489.

The most important tags

  • v=DMARC1: protocol version, always in first place.
  • p: policy of the main domain. Possible values are none for pure observation, quarantine for delivery into the spam folder and reject for hard rejection.
  • rua: address for the daily aggregate reports in XML format. Mandatory for meaningful monitoring.
  • ruf: address for forensic individual reports. Mind data protection, not every provider delivers them.
  • pct: percentage of messages the policy is applied to. Ideal for rolling out in stages.
  • sp: a separate policy for subdomains. Without sp, subdomains inherit the p value of the main domain.
  • adkim and aspf: alignment mode for DKIM and SPF, r for relaxed or s for strict.

Starting with p=none

The start is always with p=none. This policy does not change delivery and collects reports through the rua address over several weeks. If the rua address lies inside the tenant domain, Conbool collects the reports automatically through the existing mail flow. The setup wizard in the portal shows the exact record and checks it through a live DNS lookup.

Activating DMARC Reports with the module switch, notifications and retention

Activate the module and start the analysis.

Common mistakes

  • Starting straight with p=reject and losing legitimate mail streams.
  • Storing no rua, which leaves DMARC blind.
  • Forgetting subdomains, which inherit the main domain policy unintentionally without sp.

Next

After publication follows analysing the aggregate reports and after that the staged policy migration. How SPF and DKIM form the foundation is shown in SPF and DKIM as the foundation of DMARC. A detailed guide with examples is available under creating a DMARC record.