DMARC — Domain-based Message Authentication

DMARC ties SPF and DKIM together into an enforceable policy. It tells receiving mail systems: "if a message claiming to be from my domain fails SPF and DKIM, here's what to do — ignore it, quarantine it, or reject it outright." Without DMARC, spoofers can put your domain in the From: header and receivers have no reliable signal to reject.

What you'll add

One TXT record at the _dmarc subdomain:

Host:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

Swap yourdomain.com for your actual domain. The rua address receives aggregate reports — we recommend creating a new alias rather than piping them to your main inbox (the volume is low but noisy).

The policy tags

Tag	Meaning
`v=DMARC1`	Version identifier. Always required, always `DMARC1`.
`p=none`	Monitor only — no enforcement. Receivers still send reports. Start here.
`p=quarantine`	Mail that fails goes to the spam folder. Middle gear.
`p=reject`	Mail that fails is bounced. Final gear — turn on once you're confident.
`rua=mailto:…`	Where to send aggregate reports (daily XML). Pick an alias.
`ruf=mailto:…`	Where to send forensic reports (per-failure). Often noisy; optional.
`fo=1`	Generate reports if either SPF or DKIM fails. Default is 0 (both must fail).
`pct=N`	Apply the policy to N% of messages. Useful during rollout (e.g. pct=10).

Rollout — monitor → quarantine → reject

Week 1–2 — monitor. Publish p=none. Watch the aggregate reports that land in your rua inbox. Look for legitimate sources failing SPF or DKIM (marketing automation, ticketing systems, anything else that sends "from" your domain) and fix their alignment.
Week 3–4 — quarantine partial. Move to p=quarantine; pct=10. Only 10% of failing mail is quarantined — keeps damage limited if a legitimate sender slips through. Watch for complaints.
Week 4–6 — quarantine full. p=quarantine (no pct).
Week 6+ — reject. Once reports are clean, move to p=reject.

You can use a free DMARC report parser like dmarcian or Postmark DMARC Digests (free) to turn the XML into a human-readable dashboard.

Common gotchas

Subdomain policies. Add sp=quarantine (or reject) if you want the same policy for all subdomains. Without it, subdomains inherit p=, which is usually what you want.
Alignment. SPF and DKIM both need to pass and align — the Return-Path / DKIM d= must match the From: domain. Cold-email providers usually handle this automatically, but misconfigured forwarders break it.
Multiple DMARC records. Like SPF, only one DMARC record per domain. Duplicates fail validation silently.

Verify

Once published, run Settings → Domain health to confirm we can read the record. From a terminal: dig txt _dmarc.yourdomain.com.