webzod
account

Publish a DMARC record, starting in monitoring mode

email.dmarc.missing · effort: about an hour

Why it matters

Without DMARC, receivers have no instruction for mail that fails SPF and DKIM, so anyone can send mail that claims to come from your domain. DMARC also sends you reports showing who is sending as you.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Stage 1, now: publish p=none with an rua address. p=none changes nothing about delivery; it only starts the daily reports. Create the mailbox in rua (or use a DMARC report service) first, because reports can be large.
  2. If rua points at a different domain than the one you protect, that other domain must publish a TXT authorising it (name yourdomain._report._dmarc.otherdomain, value v=DMARC1) or most receivers will not send the reports.
  3. Stage 2, after a few weeks of reports show every legitimate sender passing SPF or DKIM in alignment: change p=none to p=quarantine. Stage 3, after clean reports again: change to p=reject. Do not use pct to ease in; RFC 9989 removed it and receivers do not apply partial values reliably.
  4. Make sure SPF and DKIM are set up for every service that sends your mail before moving past stage 1; DMARC enforcement blocks mail from any sender you forgot.
  5. If the domain sends no mail at all, skip the stages and publish p=reject straight away (see the second record in the snippet), together with SPF v=spf1 -all. Leave out rua, or point it at a mailbox on a domain that does receive mail; that other domain must publish a TXT record at example.com._report._dmarc.<that domain> with the value v=DMARC1. Only if no mailbox uses this domain, also add a null MX.
dns 
; Stage 1: monitoring only. Replace the mailbox with one you read or a report service address
_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

; Domain that sends no mail: publish this instead (no rua: this domain has no mailbox to read reports)
; _dmarc.example.com.  IN TXT  "v=DMARC1; p=reject"
; Only if no mailbox uses this domain, also publish a null MX (RFC 7505)
; example.com.  IN MX  0 .

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.