Check whether your domain already has a DMARC record, then build the right policy for where you are in the journey. Start with monitoring, gain visibility, and tighten enforcement as you go.
No enforcement. Use this to collect data first.
Daily or weekly XML reports from receivers
Per message failure reports (high volume)
_dmarcdig TXT _dmarc.yourdomain.comEmail authentication is the foundation of deliverability. Without a DMARC record, your domain is open to spoofing and phishing, because receivers have no policy telling them what to do with unauthenticated mail. Bad actors can send messages that appear to come from you, which erodes the reputation you have built with recipients and mailbox providers alike.
Gmail and Yahoo now require DMARC for bulk senders. If you send more than five thousand messages a day, mail that fails authentication can be rejected or sent to spam. Even smaller senders gain better inbox placement and fewer bounces when a clear policy is published, because receivers trust domains that take responsibility for their mail.
A DMARC record also gives you visibility into who sends mail for your domain. Aggregate reports, delivered to your RUA address, show which services authenticate cleanly and which need attention. Over time you move from monitoring to enforcement, protecting your domain reputation at every stage without guessing.
Start by entering your domain to check for an existing record. If none exists, use the generator below to create one. If you are new to DMARC, begin with p=none so you collect data without changing delivery. Add your RUA email to receive aggregate reports from the major mailbox providers, which show every source that sends mail from your domain and whether it passes.
Once you have a couple of weeks of reports, strengthen the policy to p=quarantine. This tells receivers to send unauthenticated mail to spam. Confirm that real mail is unaffected, then move to p=reject for full protection. Use the advanced options to tune alignment and reporting intervals for your setup.
Copy the generated TXT record and add it to your DNS host for _dmarc.yourdomain.com. Use the dig command from the setup guide to confirm propagation. Review your aggregate reports each week so any new unauthorized sender shows up before it becomes a problem.