What is DMARC? Explained in plain language
DMARC is a setting for your domain name that tells receiving mail servers what to do with email that claims to come from your domain but does not really come from you. It protects you and the people you email against fake email in your name (spoofing and phishing) and helps your real email arrive.
In short
- DMARC is a TXT record in the DNS of your domain, named
_dmarc. - It builds on two other checks: SPF (which servers may send email for your domain) and DKIM (a digital signature on every email).
- In the DMARC record you choose a policy: do nothing, send to spam or reject.
- Large mail providers such as Gmail, Outlook and Yahoo now expect a DMARC record. Without DMARC, your email ends up in spam more often.
Why do you need DMARC?
Anyone can send an email with a sender that looks like your address, for example info@yourdomain.com. The recipient does not immediately see that it is fake. Scammers use this to forge invoices or steal passwords. With DMARC you show which email really comes from you and ask the recipient to reject fake email or move it to spam.
How does it work?
When an email arrives with your domain as the sender, the receiving mail server checks three things:
- SPF: was the email sent from a server listed in the SPF record of your domain?
- DKIM: is the digital signature that your mail server added to the email valid?
- DMARC: does the approved SPF or DKIM check really belong to the domain in the sender address? If so, the email is fine. If not, the recipient follows the policy in your DMARC record.
What does a DMARC record look like?
A DMARC record is a TXT record on _dmarc.yourdomain.com, for example:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
| Part | Meaning |
|---|---|
v=DMARC1 | This is a DMARC record. Always comes first. |
p=none | Policy "do nothing": the recipient delivers the email as usual, but you can receive reports. A good place to start. |
p=quarantine | Policy "quarantine": email that fails the check goes to the spam folder. This is what we recommend by default. |
p=reject | Policy "reject": email that fails the check is not delivered at all. The strictest and safest setting. |
rua=mailto:... | Optional: an email address where you receive daily reports about who sends email on behalf of your domain. |
Getting started step by step
- Make sure SPF is correct. If you also send email through another service, such as a newsletter tool or Microsoft 365, add it to your SPF record as well. Read Adding or changing an SPF record in DirectAdmin.
- Make sure DKIM is enabled. With a WebOké hosting package, DKIM is enabled by default for email sent through our servers.
- Create the DMARC record. If in doubt, start with
p=noneand a report address, and move top=quarantineorp=rejectafter a few weeks. How to create the record is explained in Creating a DMARC record in DirectAdmin. You can also do it in My WebOké, under My domains, in DNS. - Check your settings. Our free email check shows straight away whether SPF, DKIM and DMARC are set up correctly. The Internet.nl checklist also helps.
Frequently asked questions
Will my own email be rejected if I enable DMARC?
Not if SPF and DKIM are set up correctly. If you send email through a service that is not in your SPF record and does not sign with your domain, that email may end up in spam or be rejected with p=quarantine or p=reject. So if in doubt, start with p=none and check the reports to see who sends email on behalf of your domain.
Do I have to enter a report address?
No. The reports are technical and mainly useful if you want to know which services send email on behalf of your domain. Preferably use a separate address, because you may receive a few every day.
I use Microsoft 365 or Google Workspace. Does DMARC work then too?
Yes. Add the service to your SPF record, enable DKIM in that service and then create the DMARC record at WebOké. The order matters: first SPF and DKIM, then DMARC.
Do you have a DMARC record ready for me?
Yes. The email check and My WebOké suggest the record v=DMARC1; p=quarantine if there is no DMARC record yet. If you get stuck, send us a message: we are happy to help.