# What is DMARC and how to configure it?

Starting in February 2024, [Gmail](https://blog.google/products/gmail/gmail-security-authentication-spam-protection/) and [Yahoo](https://blog.postmaster.yahooinc.com/post/730172167494483968/more-secure-less-spam) are rolling out new authentication requirements which require using a [custom **DKIM** authenticated domain](https://www.getresponse.com/help/what-is-dkim-and-how-do-i-configure-it.html) with [**DMARC** reinforced](https://www.getresponse.com/help/what-is-dmarc.html).

In April 2025, [Microsoft](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) joined them with a similar announcement.

GetResponse strongly advises all senders to use email addresses from their own private domains as a [from email address](https://www.getresponse.com/help/how-can-i-add-a-new-from-address-and-name-for-my-messages.html), and to configure both **DKIM** and **DMARC**.

For additional details on these modifications, refer to our blog posts:  
[Gmail and Yahoo’s Authentication Changes: All You Need to Know](https://www.getresponse.com/blog/gmail-yahoo-authentication)  
[Microsoft’s new authentication requirements — All you need to know](https://www.getresponse.com/blog/microsoft-authentication)

What is DMARC
-------------

**DMARC** stands for **Domain-based Message Authentication, Reporting & Conformance**. It’s an email authentication, policy, and reporting protocol. It builds on the widely used **SPF** and **[DKIM](https://www.getresponse.com/help/what-is-dkim-and-how-do-i-configure-it.html)** protocols to improve and monitor the protection of a domain from fraudulent email, adding links to the FROM domains, published policies for recipient handling of authentication failures, and reporting from receivers to senders.

It also allows a domain owner to request notifications about emails that look like they’re sent from their domain, but they aren’t correctly authenticated.

Setting up a DMARC record
-------------------------

Before you begin configuring DMARC:

*   [Configure Domain Keys Identified Mail (DKIM)](https://www.getresponse.com/help/what-is-dkim-and-how-do-i-configure-it.html)
*   Verify if a DMARC record already exists by loging in to your domain hosting panel

In the DMARC TXT record, the DMARC policy is defined. Configuring a DMARC policy sets the level of stringency for checking messages and what actions are recommended for a server receiving a message if authentication fails.

To set up basic DMARC functions, you need to add the appropriate record in your domain’s DNS server settings. Prepare a TXT record defining the basic text for the DMARC record and then add or update this file in your domain delivery DNS settings from which your email marketing campaigns are sent.

A DMARC policy can be set in one record. Here’s an example of the simplest record that can be used:

    v=DMARC1; p=none;

The DMARC record name (host) should be `**_dmarc.yourdomain.com**`, where **yourdomain.com** needs to be replaced by actual domain URL.

Another example would be:

    v=DMARC1; p=reject; rua=mailto:postmaster@example.com, mailto:dmarc@example.com; pct=100; adkim=s; aspf=s

**Note**: email addresses need to be changed to actual working emails you have access to. Tags used in this example might not be suited for everyone, please read their description below.

A DMARC record comprises mandatory and optional tags, defining policies for email authentication. A fundamental example of a DMARC record must include the following essential tags:

*   **v** tag – informs about DMARC versions, it is always set as **DMARC1**
*   **p** tag – contains information on what servers must do with messages that fail authentication, there are three policies to choose from:
    *   **p=none** – monitors emails sent on your domain without altering the recipients’ email servers.
    *   **p=quarantine** – redirects failing emails to junk or spam folders while still tracking sent emails.
    *   **p=reject** – refuses failing emails, causing them to bounce and not reach any recipient folder, while also tracking sent emails.

If you’re new to DMARC, it’s best to configure your policy using the **p** tag with the value set to **none**.

Over time, after analyzing incoming reports to learn how your domain is authenticated by receiving servers, you can change the setting of this tag to **quarantine** or **reject**.

Optional tags provide further customization:

*   **pct** – describes the percentage of unauthenticated emails that should be subject to DMARC recording. The range is expressed from 0 to 100, where 0 means 0% of messages and 100 means 100%. The **pct** parameter is optional, but if you do not set it in the record, its default value will be 100, which will include all messages that are not authenticated.
*   **rua=mailto:address@domain.com** – specifies an email address for reports from participating mailbox providers, aiding in identifying domain issues.
*   **adkim** – specifies the [DKIM](https://www.getresponse.com/help/what-is-dkim-and-how-do-i-configure-it.html) identifier alignment
    *   **adkim=s** – alignment will be strict, which means that the domain name must be exactly the same as the domain name entered in the DKIM mail headers.
    *   **adkim=r** – alignment will be rough,where all valid subdomains used in the header will be accepted
*   **aspf** – works similarly to **adkim**, however it relates to the SPF values.
    *   **aspf=s** – from email address must be exactly match the domain name
    *   **aspf=r** – any valid subdomain might be used in the message header

Each domain you use for sending requires setting a separate entry and taking all the actions described above. For subdomains, DMARC policies cascade. If you set them for a domain and not for subdomains, they will automatically take over the settings of the parent domain. You can set separate rules for each subdomain using the **sp** parameter.

How to add a DMARC record in specific providers
-----------------------------------------------

You can check the official instructions made by other platforms (and some by us) on how to add DMARC records here:

[123-Reg](https://www.123-reg.co.uk/support/servers/set-up-spf-dkim-or-dmarc-records-for-my-hosting-email/)

[Hover](https://knowledge.ondmarc.redsift.com/en/articles/5481935-how-to-create-txt-records-for-spf-dmarc-with-hover)

[Amazon Route 53 (AWS)](https://aws.amazon.com/blogs/messaging-and-targeting/what-is-dmarc-and-should-you-use-it/)

[Hostgator](https://easydmarc.com/blog/dmarc-spf-dkim-implementation-guide-for-hostgator/)

[Arsys](https://www.arsys.es/blog/dkim-y-dmarc-que-son-estos-registros)

[Hostinger](https://support.hostinger.com/en/articles/8412851-how-to-add-a-dmarc-record-for-hostinger-email)

[Bluehost](https://www.getresponse.com/help/how-to-add-dkim-and-dmarc-records-in-bluehost.html)

[Inmotion Hosting](https://www.inmotionhosting.com/support/edu/cpanel/dmarc-setup/)

[Cloudflare](https://dmarcly.com/blog/how-to-add-dkim-record-in-cloudflare-cloudflare-dkim-setup-guide)

[IONOS](https://www.ionos.com/help/domains/configuring-mail-servers-and-other-related-records/configuring-a-dmarc-record-for-a-domain/)

[Crazy Domains](https://www.crazydomains.com.au/help/how-to-configure-dns-records-for-proper-mail-work-on-email-hosting/)

[IWantMyName](https://help.iwantmyname.com/hc/en-gb/articles/360014832957-How-do-I-add-an-SPF-record)

[Domain.com](https://www.domain.com/help/article/what-are-dkim-and-dmarc)

[Name.com](https://support.powerdmarc.com/support/solutions/articles/60000669429-how-to-publish-a-dmarc-record-on-name-com)

[Digital Ocean](https://www.digitalocean.com/community/questions/how-to-configure-dmarc)

[Namecheap](https://www.getresponse.com/help/how-to-add-dkim-and-dmarc-records-in-namecheap.html)

[DNSimple](https://support.dnsimple.com/articles/postmark-dmarc-service/)

[NameSilo](https://forum.cloudron.io/topic/6889/namesilo-setting-up-dns-records-for-email)

[DreamHost](https://help.dreamhost.com/hc/en-us/articles/215029758-DKIM-records)

[Netlify](https://answers.netlify.com/t/how-to-create-dkim-and-dmarc-records/11486)

[Dynadot](https://support.easydmarc.com/knowledge-base/setup-dns-dynadot)

[One.com](https://help.one.com/hc/en-us/articles/360015855998-How-do-I-create-a-DMARC-record)

[Enom](https://help.enom.com/hc/en-us/articles/23331945566349-Understanding-Gmail-and-Yahoo-DMARC-requirements-for-Hosted-Email)

[OVH](https://help.ovhcloud.com/csm/en-dns-zone-dmarc?id=kb_article_view&sysparm_article=KB0059161)

[Gandi](https://docs.gandi.net/en/gandimail/common_operations/enable_antispoofing_tools.html)

[Porkbun](https://kb.porkbun.com/article/179-how-to-turn-on-dkim-dmarc)

[GoDaddy](https://www.getresponse.com/help/how-to-add-dkim-and-dmarc-records-in-godaddy.html)

[Register.com](https://support.moonmail.io/article/153-authenticating-email-with-spf-in-moonmail)

[Google Domains](https://support.google.com/a/answer/2466563)

For more information on email authentication not only for beginners, please see our [blog post](https://www.getresponse.com/blog/email-authentication), and for comprehensive information on DMARC functionality, visit [dmarc.org](https://dmarc.org/).