Email DNS explained
What is DMARC?
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receiving servers what to do with mail that claims to be from your domain but fails SPF and DKIM, and where to send reports about it.
How DMARC works
A message passes DMARC when SPF or DKIM passes and lines up with the domain in the From address. Your DMARC record then tells receivers what to do with mail that fails: nothing, send it to spam, or reject it.
Gmail requires DMARC from anyone sending 5,000 or more messages a day to Gmail accounts.
Source: RFC 9989: DMARC (IETF), Email sender guidelines (Gmail Help)
The three policies
The p= tag sets the policy:
- p=none: take no action, just send reports. Start here.
- p=quarantine: treat failing mail as suspicious, usually the spam folder.
- p=reject: refuse failing mail.
Source: RFC 9989: DMARC (IETF), Recommended DMARC rollout (Google Workspace Help)
Start with p=none and tighten slowly
Set up SPF and DKIM first. Then publish DMARC with p=none and read the reports for a while, so you can see every service that sends mail as you. Move to quarantine and later to reject only when the reports look clean.
Send the reports to a mailbox or group you actually check. Only one DMARC record is allowed per domain.
Source: Recommended DMARC rollout (Google Workspace Help), DMARC policy (Zoho Mail Help)
What changed in the current standard
DMARC’s current standard (RFC 9989, 2026) made the p tag optional (leaving it out means none), dropped the old pct tag and added t=y for a test mode. Records that still have pct=100 keep working.
Source: RFC 9989: DMARC (IETF)
DMARC for your email provider
The exact values and steps for each provider:
DMARC: questions
How do I add a DMARC record?
At your DNS host, add a TXT record with the name _dmarc and a value like v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Set up SPF and DKIM first, then start with p=none.
Why does DMARC fail?
DMARC fails when neither SPF nor DKIM passes for the domain in the From address. Common causes are a sending service missing from your SPF record, or DKIM not turned on for a service that sends as you.
Will DMARC block my own email?
Not with p=none, which only collects reports. Check the reports for services that fail before you move to quarantine or reject.
Can I have two DMARC records?
No. Only one DMARC record is allowed per domain, at _dmarc.yourdomain.com.
Ready to set it up?
Pick your email provider and DNS host to get the exact records and steps.