Get Started

How to setup dmarc

Nov 6, 2023 | Email-University, University

https://watch.screencastify.com/v/dkDepWW2dZWqvPfPAvRH

Implementing DMARC (Domain-based Message Authentication, Reporting, and Conformance) is essential for enhancing your email security and protecting your domain from phishing and spoofing attacks. Follow this step-by-step guide to set up DMARC for your domain:

1. Ensure SPF and DKIM Are Configured

Before setting up DMARC, confirm that both SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are properly configured for your domain. These protocols authenticate your emails and are prerequisites for DMARC.

Microsoft Learn

2. Create a DMARC Record

A DMARC record is a TXT record added to your domain’s DNS settings. It specifies your DMARC policy and provides instructions on how to handle emails that fail authentication.

  • Record Name (Host): _dmarc.yourdomain.com
  • Record Type: TXT
  • Value: v=DMARC1; p=none; rua=mailto:dmarcreports@yourdomain.com; ruf=mailto:dmarcforensic@yourdomain.com;

Explanation of Tags:

  • v=DMARC1: Specifies the DMARC version.
  • p=none: Policy for handling emails that fail DMARC checks (none, quarantine, or reject). Starting with none allows you to monitor without affecting email delivery.
  • rua=mailto:dmarcreports@yourdomain.com: Address to receive aggregate reports.
  • ruf=mailto:dmarcforensic@yourdomain.com: Address to receive forensic reports.

Note: Replace yourdomain.com with your actual domain and ensure the email addresses for reports are valid and monitored.

3. Publish the DMARC Record

Access your DNS management console through your domain registrar or hosting provider.

  • Add a New TXT Record:
    • Name/Host: _dmarc
    • Type: TXT
    • Value: Paste the DMARC record value created in step 2.

Save the changes to publish the DMARC record. Propagation may take up to 48 hours.

MXToolbox

4. Monitor DMARC Reports

After publishing, you’ll start receiving DMARC reports at the specified email addresses. These reports provide insights into email authentication results and potential issues.

  • Aggregate Reports: Summarize authentication results over a period.
  • Forensic Reports: Provide detailed information on individual emails that failed authentication.

Regularly review these reports to understand your email authentication status and identify any unauthorized use of your domain.

5. Adjust DMARC Policy as Needed

Based on the insights from the reports, you can adjust your DMARC policy to a stricter setting:

  • p=quarantine: Emails that fail DMARC checks are marked as spam or placed in the recipient’s junk folder.
  • p=reject: Emails that fail DMARC checks are rejected and not delivered.

Implement these stricter policies gradually, ensuring legitimate emails are not affected.

EasyDMARC

By following these steps, you can effectively set up DMARC to protect your domain from email-based threats and improve your overall email security posture.