DMARC record

Per RFC 7489

Phased rollout from p=none through quarantine to reject; with Mailcheck as the RUA address.

What is this, and when do I need it?

What is this?

DMARC (Domain-based Message Authentication, Reporting & Conformance, RFC 7489) is the bracket around SPF and DKIM. It tells receiving mail servers what to do when a message claims to come from your domain but neither SPF nor DKIM confirms it: deliver, move to spam, or reject.

Additionally, DMARC requires the signing domain to match the visible sender domain (alignment). That eliminates an entire class of phishing tricks where attackers sign their own domain and spoof the From line.

When do I need it?

As soon as you send mail at all - that means every company with its own domain, from a sole proprietor to a GmbH. Without DMARC, anyone can send phishing mail using your domain as the sender, and your recipients have no signal that it did not come from you.

Rollout works in three steps, 4-8 weeks each: p=none (observe only, no blocking), p=quarantine (spam folder), p=reject (block entirely). Only advance when the reports show that all your sending sources sign cleanly.

Should already be in place

SPF record published
DKIM enabled at your mail provider (usually one click in the dashboard)

Sensible next steps

Domain Apex domain without the _dmarc. prefix. The record lands at _dmarc.<domain>.

Policy (p) How should the receiver treat mail that fails both SPF and DKIM? Rollout: 4-8 weeks none, then quarantine, then reject. Subdomain policy (sp) Separate policy for subdomains (mail.example.com, ...). If empty, p applies to subdomains too. pct (% applied) What percentage of failing mail does the policy apply to? Common during rollout (e.g. 10 → 50 → 100).

rua (aggregate reports, one address per line) Recipients of the daily XML reports with statistics for all incoming mail. Format mailto:dmarc@…. A foreign domain target needs an external verifier TXT (RFC 7489 § 7.1) - GDPR-compliant EU recipients recommended. Also add Dernium Mailcheck as a RUA recipient ruf (failure reports, optional) Forensic reports of individual failed mail (header + excerpt). Many receivers have not sent ruf for years. Check GDPR implications (contains third-party content).

DKIM alignment (adkim) Must the DKIM d= domain match the From domain exactly (strict) or is a common organisational domain enough (relaxed)? Default relaxed works for most setups. SPF alignment (aspf) Like adkim for SPF: strict requires the exact domain match between MailFrom and From, relaxed accepts the organisational domain.

Failure reporting options (fo)

0 - SPF+DKIM fail 1 - SPF or DKIM fail d - DKIM fail s - SPF fail

p=none ist nur für die Beobachtungsphase gedacht. Innerhalb von 4-8 Wochen auf quarantine oder reject erhöhen, sonst wirkt der Record nicht.

DNS TXT record per RFC 7489

_dmarc.example.com.	TXT	"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=0;"

Publish the record at _dmarc.example.com. Recommended rollout: p=none with rua for 4-8 weeks, then quarantine, then reject.

How to add this record at your DNS provider

The record generated above has three parts: the record type (typically TXT, occasionally CAA), the host (a subdomain like _dmarc, _smtp._tls or empty for the root domain) and the value (the actual payload in quotes). Every DNS provider asks for these same three fields - only the menu wording differs.

INWX (Dernium default for new customers)

Sign in at www.inwx.de.
Tab Nameserver → pick the domain → Nameserver-Sets verwalten → DNS-Einträge.
Button Neuen Eintrag anlegen.
Pick a type (e.g. TXT), enter the host (empty for the root domain, otherwise e.g. _dmarc), paste the value, leave TTL at 3600.
Save. Propagation typically within 5-15 minutes.

Strato

Sign in to the Strato customer area.
Menu Domains → pick the domain → Verwalten.
Section DNS-Verwaltung → Nameserver/DNS-Einstellungen anpassen.
Under Eigene DNS-Verwaltung pick the right record type (TXT records have their own block), enter host and value.
Save. Strato typically propagates within 30-60 minutes.

Hetzner DNS Console

Sign in at dns.hetzner.com.
Click on the zone of your domain.
Button Add record → pick a type, enter the name (use @ for the root domain), paste the value.
Save. Propagation typically under 5 minutes.

IONOS (1&1)

Sign in to the IONOS customer center.
Menu Domains & SSL → click the domain → DNS.
Button Eintrag hinzufügen → pick a type, enter the host, paste the value into the content field.
Save. Propagation typically 15-60 minutes.

Cloudflare

Sign in to Cloudflare, pick the domain.
Tab DNS → Records.
Button Add record → pick a type, enter the name (use @ for the root domain), paste the value, leave proxy status on DNS only for TXT/CAA records.
Save. Propagation typically under 2 minutes.

Note: If your DNS provider is not listed, you usually find the right place under headings like "DNS management", "Zone editor", or "Records". When in doubt, your provider's support helps; the paths shown here are vendor-specific and can shift slightly with redesigns.

Inspect an existing DMARC record

Reads _dmarc.<domain> and validates tags against RFC 7489.

Try with:

Server path: this inspection does NOT run browser-local. We fetch the DNS record or HTTPS response via our server. We do not log the queried domain or the result. 12 requests per minute per IPv4 address or IPv6 /64 subnet.