Chapter 5 · 5.9
Setting up DMARC
DMARC is the third step after SPF and DKIM. With a DMARC record, you tell recipients what to do with mail that claims to come from your domain but doesn't pass the SPF or DKIM check. This makes it harder for scammers to send mail in your domain's name. Large providers such as Gmail and Yahoo require senders to have a DMARC record.
The DMARC record at WebOké
A hosting package comes with a DMARC record by default: a TXT record with the name _dmarc and the value v=DMARC1;p=reject. This means mail that doesn't pass the check is rejected. This is the strictest setting and gives the best protection against misuse of your domain. If all your mail goes through WebOké, SPF and DKIM will automatically be correct, so you can leave it as it is.
Do you also send mail through another service, or are you creating a new DMARC record yourself? Then take it step by step: start with None and a report address, check the reports for a few weeks to see whether all your own mail passes the check, then choose Quarantine and after that Reject.
Adjusting the DMARC record
- Open DNS Administration.
- Click the pencil behind the TXT record with the name _dmarc. If there isn't one yet, click ADD RECORD, choose TXT, enter _dmarc as the name, and under TXT Record Type choose DMARC.
- Under Domain policy type, choose what should happen with mail that doesn't pass the check.
- If you like, enter an email address for reports under Aggregate Email (RUA).
- Check at the bottom under Value what the record will look like, and save.
Which policy should you choose?
| Domain policy type | In the record | What happens? |
|---|---|---|
| None | p=none | Nothing. Recipients only send reports (if you enter an RUA address). Start with this if you also send mail through other services or are creating a new record yourself. |
| Quarantine | p=quarantine | Mail that doesn't pass the check goes to the spam folder. The second step, once the reports look good. |
| Reject | p=reject | Mail that doesn't pass the check is rejected. The goal, and the default for a WebOké hosting package. |
Please note: With Quarantine or Reject, it's extra important that your SPF record is correct. If you also send mail through another service (your accounting software, a newsletter service, Microsoft 365), add that service to your SPF record first (see Setting up and adding to SPF) and, if possible, enable DKIM for that service (see Turning on and checking DKIM). Otherwise, recipients will reject mail from that service. If you're not sure, temporarily set the policy to None and then move step by step towards Reject again.
The other fields
- Subdomain policy type: a different policy for subdomains. Leave empty to use the same policy.
- Aggregate Email (RUA): this gives you a daily overview (in XML) of who sent mail on behalf of your domain. Useful for checking, but these are technical files. You can leave this empty.
- Forensic Email (RUF): reports about individual failed messages. Few providers still send these. Leave empty.
- Percentage: what percentage of mail the policy applies to. Leave this at 100. This field will disappear in the new DMARC standard (RFC 9989, 2026); your existing record will keep working.
- Alignment mode for DKIM and Alignment mode for SPF: leave these set to Relaxed.
Frequently asked questions
I've deleted the _dmarc record, but I still see it
Other computers still remember the record until the TTL has passed. For the DMARC record, this is 14400 seconds by default: four hours. So just wait a while (see When does a change take effect? Waiting time and TTL).
Can I have two DMARC records?
No. Just like with SPF, you can only have one DMARC record. Adjust the existing record instead.