DMARC
In one line
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails the SPF and DKIM checks. It can also ask them to send you reports about what they see.
The rule on top of the checks
SPF and DKIM check mail. DMARC decides what happens when a check fails. You publish a policy, and receiving servers follow it. It also adds a rule that the domain in the visible "from" address must match the one that passed a check, which stops a common trick.
What a record looks like
DMARC is a TXT record placed at a fixed name, _dmarc, in front of your domain. A cautious starting record reads:
v=DMARC1; p=none; rua=mailto:[email protected]
The p value is the policy. The rua value is an address that receives summary reports. Use an address that really exists and that you will read, and expect the reports to be machine-written files.
Three policies
- none means "do nothing, just report". It is the safe place to begin.
- quarantine asks receivers to treat failing mail as suspicious, often by sending it to spam.
- reject asks receivers to refuse failing mail entirely.
Start gently
Begin with none and watch the reports for a few weeks. They show which services send mail as your domain, including ones you may have forgotten. Fix any that fail SPF or DKIM, then move to quarantine, and later to reject if you are confident. Jumping straight to reject can block your own legitimate mail, such as a newsletter tool you set up long ago.
Does it matter for a small site?
If your domain sends or receives email, yes, because large mailbox providers increasingly expect it. If your domain only hosts a website and never sends mail, a strict policy can still stop others from faking messages in your name. When you connect a domain to a casa, leave existing mail records alone. Custom domains are in preview, and our custom domain guide shows which records to add and which to leave.
Questions people ask
Which DMARC policy should I start with?
Start with none. It asks receivers to report without changing how they treat mail, so you can see who sends as your domain. Move to quarantine and then reject only when the reports look clean.
Where does a DMARC record go?
It is a TXT record at the name _dmarc in front of your domain, for example _dmarc.example.com. Add it at the DNS host that holds your records, which is where your nameservers point.