A DMARC (Domain-based Message Authentication, Reporting and Conformance) record is a DNS record that tells receiving mail servers how to handle emails that fail authentication checks for your domain. It helps protect your domain against email spoofing, where someone sends an email pretending to be you.
DMARC works alongside two other email authentication technologies:
- SPF – specifies which servers are authorised to send email for your domain.
- DKIM – adds a digital signature to outgoing emails so receiving servers can verify their authenticity.
- DMARC – checks authentication against the domain in the visible From address and specifies how failed messages should be handled.
How DMARC works
- An email is sent using your domain in the From address.
- The receiving mail server checks SPF and DKIM.
- It checks whether the domain authenticated by SPF or DKIM matches the domain in the visible From address. This is called domain alignment.
- The email passes DMARC if at least one of these checks passes with alignment.
- If neither passes with alignment, the receiving server uses your DMARC policy to help decide how to handle the message.
Both SPF and DKIM do not need to pass for DMARC to pass. However, configuring both is recommended.
What does a DMARC DNS record look like?
DMARC is published as a TXT record under the hostname _dmarc. For example, _dmarc.yourdomainname.co.nz and the value would be V=DMARC1; p=none;
Replace yourdomainname.co.nz with your domain name.
Where:
- v=DMARC1 identifies the record as DMARC.
- p=none requests no quarantine or rejection based on DMARC failures.
The reporting address is optional, but including it helps you identify legitimate sending services that need attention. Reports are generally provided as XML files, which a DMARC reporting service can help interpret.
What are the DMARC policy options?
| Policy | Requested action for messages that fail DMARC |
| p=none | Monitor authentication without requesting quarantine or rejection. |
| p=quarantine | Treat the message as suspicious, usually placing it in spam or junk. |
| p=reject | Reject the message |
Receiving servers still apply their own filtering rules. A p=none policy does not guarantee inbox delivery.
How to add a DMARC record with 1st Domains
If your DNS is managed by 1st Domains:
- Log in to your 1st Domains account.
- Click Manage Domains & Services.
- Select the domain name.
- Under Services, click Manage DNS Zone Records.
- Check for an existing TXT record at _dmarc. If one exists, edit it rather than adding another.
- Otherwise, click Add Record and enter:
| Field | Value |
| Host Name | _dmarc.yourdomainname.co.nz |
| Record Type | TXT |
| Value | v=DMARC1; p-none; |
Click Update to save your changes. The default DNS TTL is one hour, so allow time for cached records to refresh.
Why is DMARC important?
DMARC helps you understand who is sending email using your domain. Once an enforcement policy is enabled, it also asks receiving servers to quarantine or reject messages that fail authentication, helping protect customers and contacts from emails impersonating your domain.