How to configure DMARC

Quick answer: DMARC ties SPF and DKIM together: a TXT record at _dmarc.yourdomain.com tells receivers what to do with mail that fails authentication. Start with v=DMARC1; p=none; rua=mailto:[email protected], review the reports, then tighten to quarantine and finally reject.

Overview

Without DMARC anyone can spoof your domain in the From header even when you have SPF and DKIM. DMARC enforces alignment — the visible From domain must match what SPF/DKIM authenticated — and gives you aggregate reports showing who is sending as your domain. Providers increasingly require a DMARC record from anyone sending meaningful volume.

Before you start

• Working SPF and DKIM — DMARC is meaningless without at least one of them passing with alignment.
• A mailbox to receive aggregate reports (rua).

Step-by-step guide

1. Publish the monitoring record:

   _dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

2. Wait one to two weeks and review the XML reports (or feed them to a free DMARC report viewer) — confirm all legitimate senders pass.
3. Tighten gradually: p=quarantine (failures go to spam), optionally with pct=25 to phase in.
4. Finish at p=reject once reports show only legitimate mail passing.
5. Verify the record:

   dig +short TXT _dmarc.yourdomain.com

Common issues

• Jumping straight to p=reject: a forgotten legitimate sender (CRM, invoicing tool) silently loses mail — always start at p=none.
• Alignment failures with a relay: services sending "on behalf of" your domain must sign with your DKIM key or use a matching return-path.
• No reports arriving: the rua mailbox must exist and accept mail from external senders.

When to contact support

DMARC issues are DNS- and sender-side; if reports show unexpected sending from Cloud2Y IP ranges that are not yours, open a ticket so we can investigate possible abuse.

Frequently asked questions

Why start DMARC with p=none?

The none policy changes nothing for delivery but sends you aggregate reports, letting you find every legitimate sender before failures start being quarantined or rejected.

How long should each DMARC stage last?

Watch reports for one to two weeks at p=none, run p=quarantine for a similar period once clean, then move to p=reject when reports show only legitimate mail passing alignment.

What are rua reports?

Aggregate XML summaries that receiving providers send to the mailbox in your rua tag, showing which IPs sent mail as your domain and whether SPF and DKIM passed for them.

Related articles

• How to configure SPF
• How to configure DKIM
• How to avoid email going to spam
• How to configure DNS for email services

Need a hand? Contact Cloud2Y support →