Articles in this section

Adding a DMARC record to your Domain Name System (DNS)

Avatar
Zane Pimiskern
Updated
Follow

On this page

Why do MC Professional customers need to think about DMARC?

Google has announced that starting February 2024, a DMARC record is required for all senders who submit more than 5000 emails daily to the Gmail.com domain. Yahoo has also announced that DMARC is required at that time.

This article is for MC Professional accounts who's custom domain is managed by another domain provider (Network Solutions, GoDaddy, etc.). If your custom domain is currently managed by MC Professional, we've added a DMARC record to your domain's DNS records on your behalf. If you wish to customize your DMARC record further, please submit a support request.

Don't know who your domain name provider is? Click here then enter your domain name in the field and click the Search button. Look for the name of your domain name provider in the Registrar field.

What is a DMARC record?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. DMARC is a way for email senders to define how they protect messages they send. Recipient servers view DMARC records to see how the sender wants their messages validated. DMARC lets you tell receiving servers what to do with outgoing messages from your organization that don’t pass SPF or DKIM checks. DMARC removes guesswork from the receiver’s handling of these failed messages, limiting or eliminating the user’s exposure to potentially fraudulent and harmful messages.

A few notes about DMARC:

  • A DMARC policy allows a sender to indicate to the public that their messages are protected by SPF and/or DKIM.
  • DMARC tells a receiver what to do if neither SPF or DKIM authentication methods passes, such as junk or reject the message.
  • DMARC also tells the email receiver how it can report back to you about messages that are blocked by the recipients email server.

You must reach out to your custom domain manager to add a DMARC record to your DNS. DMARC should not be turned on until you've set up a DKIM and SPF record in your DNS. You must determine what value you want to put in your DMARC policy. If you don't have a preference, you can add the following example to have no impact on your domain but appease the requirement: v=DMARC1; p=none;

How does DMARC work in non-technical terms?

The recipient takes the sender’s email address from the message and uses DNS to look up your organization’s DMARC policy. If the recipient rejects your message, what happens next is based on your DMARC policy.

To add a DMARC record to your DNS

Before adding a DMARC record, you must add SPF and DKIM records to your DNS settings if you have not already done so. These records help the recipient validate your message’s authenticity.

The minimum requirement is a policy that does not specify what to do with messages that fail authentication, such as: v=DMARC1; p=none;

In the root of your public DNS zone, create a TXT record. Add the name _dmarc and in the content section add your DMARC policy. This establishes your DMARC policy and you can then work on enhancing this posture with additional options like:

  • Creating a reporting email address.
  • Reviewing reports to see what messages have failed.
  • Remediating sources that are sending unauthenticated emails on your behalf.
  • Tightening the policy to reject messages that don’t pass authentication.

We recommend using a DMARC record wizard to help avoid any error in adding your DMARC record.

As an example, you might create a DMARC record to quarantine messages that fail with strict SPF checking but relaxed DKIM checking and to send aggregate reports to dmarc@memberclicks.com. This would look like: v=DMARC1; p=quarantine; rua=mailto:dmarc@personifycorp.com; aspf=s;

Additional resources

Related articles