Skip to content
Raszio
EN
Browse the Help Center

What DMARC is and how to set it up

How the DMARC record protects your domain against fraud and what each parameter means.

This page is for whoever manages the domain’s DNS. If your domain is managed by Raszio, we set up DMARC for you.

What DMARC is

DMARC is a text record (TXT) published in your domain’s DNS. It tells other providers what to do with a message that claims to come from your domain but fails the SPF and DKIM checks. This helps stop scammers from sending emails pretending to be your company.

DMARC also asks providers to send reports to one of your addresses. These reports show who is sending messages on behalf of your domain, including services you didn’t know were using your address.

Requirements

DMARC relies on the results of SPF and DKIM, so at least one of the two must be set up. The record is published as TXT under the domain’s _dmarc name, such as _dmarc.yourcompany.com.

Parameters

Policy (p)

What to do with a message that fails the checks:

  • p=none: do nothing, just send the reports. Use it to start and observe.
  • p=quarantine: send the message to quarantine, usually the spam folder.
  • p=reject: refuse the message.

Subdomain policy (sp)

The same as p, but for subdomains, such as sales.yourcompany.com. It takes the same values: none, quarantine or reject. Without sp, subdomains follow the p policy.

Aggregate report (rua)

The address that receives the aggregate reports, usually sent once a day. They summarize how many messages on behalf of your domain passed or failed the checks, and which servers they came from.

rua=mailto:dmarc@yourcompany.com

Failure report (ruf)

The address that receives individual reports on messages that failed the checks. Few providers send this type of report.

ruf=mailto:dmarc@yourcompany.com

SPF alignment (aspf)

How closely the domain checked by SPF must match the sender’s domain:

  • aspf=r (relaxed, the default): it only needs to be the same main domain. A subdomain, such as mail.yourcompany.com, also passes.
  • aspf=s (strict): the domain must be exactly the same.

DKIM alignment (adkim)

The same as aspf, but for the DKIM signature’s domain:

  • adkim=r (relaxed, the default): it only needs to be the same main domain.
  • adkim=s (strict): the domain must be exactly the same.

Percentage (pct)

The percentage of messages the policy applies to. It lets you tighten the policy gradually and watch the impact.

  • pct=10: applies the policy to 10% of the messages that fail.
  • pct=100: applies it to all of them. This is the default.

Examples

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

Takes no action on messages that fail, it only sends the aggregate report to dmarc@yourcompany.com. It’s the safe way to start.

v=DMARC1; p=quarantine; sp=reject; pct=50; adkim=s; aspf=s; rua=mailto:dmarc@yourcompany.com; ruf=mailto:forensics@yourcompany.com

Applies the policy to half of the messages that fail: on the main domain, they go to quarantine; on subdomains, they’re refused. Requires strict SPF and DKIM alignment. Aggregate reports go to dmarc@yourcompany.com and failure reports to forensics@yourcompany.com.