This article explains what DMARC is and provides an example for how to set it up.

As of February 2024, Google and Yahoo have increased their enforcement of domain authentication. To avoid issues with email delivery, it’s crucial to complete DKIM, DMARC, and SPF authentication for the domain you use to send emails.

⚠	Warning
	You must set up DKIM before configuring DMARC.

 

	In This Article
	Video Tutorial What Is DMARC? Checking for DMARC Setting Up DMARC Step 1: Choose a DMARC Policy Step 2: Create a DMARC TXT Record Step 3: Check Your DMARC Policy Settings Monitoring and Testing DMARC Frequently Asked Questions Additional Resources

Watch a Video Tutorial on Email Authentication Setup

What Is DMARC?

Domain-based Message Authentication, Reporting and Conformance (DMARC) is a form of authentication that adds an extra layer of security to emails sent from your domain. By specifying a policy (e.g., none, quarantine, or reject) for unauthenticated emails, DMARC helps prevent spoofing and provides insight into potential abuse of your domain.

⚠	Warning
	You must set up DKIM before configuring DMARC.

Checking for DMARC

If you’re not sure whether your domain already has a DMARC policy or not, you can easily find out right in your Emma account. You must have DKIM set up before you can use this tool.

1. Navigate to your Account > Deliverability tab.
   • Parent account: Click on the gear icon in the upper right corner of your screen and choose Account from the dropdown menu.
   • Subaccounts: Navigate to the appropriate subaccount and click on the gear icon in the upper right corner of your screen.
     • If you are a Manager or Parent user, scroll down to "Subaccount settings" and choose Account from the dropdown menu.
     • If you are an Administrator user, choose Account from the dropdown menu.
   • Standalone accounts: Click on the gear icon in the upper right corner of your screen and choose Account from the dropdown menu.
2. On the next screen, click on the Deliverability tab.
3. Scroll down to the section that says "DMARC status check".
4. Click on the Check DMARC status button.

If your domain has a DMARC policy, a green pill icon will appear in the "Policy" row, showing the policy type:

• None: Your DMARC policy is p=none
• Quarantine: Your DMARC policy is p=quarantine
• Reject: Your DMARC policy is p=reject

All of these options are valid DMARC policies.

If the DMARC status check tool cannot find a DMARC policy on your domain, or if it encounters an error, then you will see an error message.

Seeing an error message?

Error messages typically contain information that indicates the source of the problem. For example, if you see an error message that states that your domain has more than one DMARC record, then the problem is that your domain has more than one DMARC record and you will need to remove one. For more information about error messages, check out the FAQ section.

Setting Up DMARC

DMARC setup requires adding a TXT record to your DNS that specifies your DMARC policy and includes optional settings for reporting. DMARC setup can vary based on your organization's needs. It's best done by someone with DNS expertise, as it requires testing, reviewing technical reports, and securing mail streams.

Step 1: Choose a DMARC Policy

Decide how you want unauthenticated emails to be treated:

• p=none: Monitors email without taking action on unauthorized emails
• p=quarantine: Sends unauthorized emails to spam
• p=reject: Blocks unauthorized emails from reaching recipients

⚠	Warning
	Only use a quarantine or reject policy if you are sure that DKIM is set up for all of your email traffic.

Step 2: Create a DMARC TXT Record

Below is an example of the minimum requirements for a DMARC policy, which you can change later if you want to enforce a stronger policy.

1. Log in to your DNS provider's website or app.

2. Create a new TXT record and enter the following text, exactly as it appears.

   Name	Value
   _dmarc	v=DMARC1; p=none;

    

3. Select the TTL value (300 seconds - 30 minutes).
4. Save the record.

✎	Note
	This is the only DMARC setup that Emma can provide support for. If you choose to set it up differently, that's okay, but we won't be able to help with any questions or troubleshooting for other methods. For anything related to DMARC, your IT team or DNS specialist will be your go-to for assistance.

Step 3: Check Your DMARC Policy Settings

After publishing the DMARC record, allow time for propagation, then verify the settings using a DMARC lookup tool. Start with a “none” policy, then transition to quarantine or reject as you gain confidence.

How to use emailstuff.org to check your DMARC record

1. Navigate to emailstuff.org's DMARC checker tool.
2. Under the "Check a published DMARC record" heading, type your domain in the "Domain name" box.
3. Click on the Check button.

If you see a green box that says "Valid record", then your DMARC record is correct. You can view the details of your policy in the rows below.

Monitoring and Testing DMARC

Testing DMARC involves monitoring DMARC reports and checking for failed authentication attempts. DMARC reports can help you identify unauthorized use of your domain and adjust your policy settings accordingly, and you will only have access to these if you have specified an email address to receive these reports in your DMARC record.

We recommend getting help from service providers who specialize in DMARC. Listed below are two services that can help you through the DMARC implementation process.

• Redsift
• ValiMail

Frequently Asked Questions About DMARC

Ⓘ	Info
	For more frequently asked questions about DMARC, check out our frequently asked questions about email authentication article.

 

Can DMARC work without DKIM?

No, DMARC requires either DKIM or SPF to be set up. DMARC verifies that emails align with either of these protocols. However, due to changing sender guidelines, DKIM, DMARC, and SPF authentication is essential.

 

Should I set DMARC to "reject" right away?

No, it’s best to start with "p=none" to monitor performance and adjust before enforcing stricter policies.

 

I followed all of the instructions exactly, but I'm seeing an error when I try to check my DMARC in Emma! Did I do something wrong?

It can take up to 24 hours for DNS records to fully propagate, so there's no need to panic if you don’t see the DMARC record check tool update right away. Just give the records some time and then try again.

If you're still seeing errors after 24 hours, there may be a small typo in your record. Try checking the record errant spaces or typos. Additionally, if you copied and pasted the record into your DNS, try typing it in manually instead. Alternately, you can paste it into a text editor, copy it again, and then paste it into your DNS. The goal is to strip any hidden formatting that might tag along when you enter or paste the record into your DNS, as this formatting can prevent Emma from reading it.

 

Where can I find more information about creating DMARC policies?

Here are some additional resources about DMARC policies:

• Overview from DMARC.org
• What is a DNS DMARC record? from Cloudflare's Learning Center
• DMARC record generator from MX Toolbox

 

Why am I seeing an error message telling me that I have more than one DMARC record?

Each domain can only have one DMARC record. If you see an error message that says your domain has more than one DMARC record, then you need to remove the extra DMARC record(s).

 

I send less than 5,000 emails a day, do I really have to set up authentication?

Yes, you do still need to set up DKIM, DMARC, and SPF authentication. You may send less than 5,000 emails a day, but Emma sends far more than that. Sending from any email service provider (ESP), such as Emma, will qualify you as a bulk sender to inbox providers.

 

I don’t have an IT team and I don’t know how to do any of this. Where do I even put this record?

We understand that authenticating your domain can feel overwhelming, especially for someone who may not have a lot of experience with these topics. Our goal is to make this process as smooth as possible for everyone, so we've created several resources that will hopefully help you feel a little more confident. All of those resources are listed in our overview of email authentication.

As far as the DNS records are concerned, you or whoever manages your domain should be able to log in to the registrar that hosts your domain to create the required records. Every DNS provider looks a little different, so if you have specific questions about where to click or what to do, your registrar’s help documentation will be your best bet for guidance.

We’ve collected a list of some popular domain providers and their instructions for how to edit DNS records. Just click on the link that corresponds to your domain provider; if you don’t see yours listed here, try visiting your provider’s website and searching their help documents, or contact their Support team.

• Amazon Route 53: Configuring DNS, DNS Record Types
• Bluehost: DNS Management
• Cloudflare: Manage DNS Records
• Dreamhost: DNS Overview
• GoDaddy: Add a TXT Record
• Hostgator: Basics of DNS Records
• Hover: Managing DNS Records
• IONOS: Managing TXT Records
• Namecheap: How to Add a TXT Record
• Network Solutions: How to Manage DNS and Advanced DNS Records, Help & Support Home
• Siteground: Manage Your DNS Records
• Squarespace: Accessing Your DNS Settings, Adding Custom DNS Records
• Wix: Adding or Updating TXT Records
• WordPress: Manage Your DNS Records

Additional Resources

• Allowlisting Emma's Addresses
• Deliverability Hub
• Deliverability: Video Library
• DKIM and Deliverability
• DKIM Authentication Setup
• DKIM for Tiered Accounts
• Domain Names and Registrars
• Email Authentication: Frequently Asked Questions
• Email Authentication: Overview
• Email Authentication: Security
• SPF Authentication Setup