Configuring DMARC Policy
Set up DMARC to protect your domain from spoofing and phishing.
Configuring DMARC Policy
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It tells receiving servers what to do when an email fails authentication, and where to send reports about authentication results.
Prerequisites
Before setting up DMARC, ensure both SPF and DKIM are configured and passing for your domain.
Creating the DMARC Record
- On Domains → Sending domains, expand your domain and find the DMARC record in the DNS records list. It looks like:
Thev=DMARC1; p=none; rua=mailto:dmarc@mailnaptic.comruaaddress belongs to Mailnaptic so that your aggregate reports can be collected and shown in the app. Do not remove it. - In your DNS provider, create a TXT record for
_dmarc.example.comwith that value. - Return to Mailnaptic and click Check DNS. The DMARC chip turns to Verified when your record has the same policy as the one shown and includes Mailnaptic’s reporting address in
rua. Other tags are not checked.
Changing the Policy
In the DMARC Policy Enforcement section of the domain card, choose p=none, p=quarantine, or p=reject. You can move up one level at a time (none, then quarantine, then reject), and quarantine or reject require a fully verified domain. You can move back down at any time. After changing the policy, update the TXT record in your DNS to the new value shown, then click Check DNS again. Only owners and admins can change the policy.
DMARC Policy Levels
| Policy | Meaning | Recommendation |
|---|---|---|
p=none | Monitor only; no enforcement | Start here for 2–4 weeks |
p=quarantine | Suspicious emails go to spam | Move here after reviewing reports |
p=reject | Failing emails are blocked entirely | Ultimate goal for full protection |
Recommended Rollout
- Set
p=noneand monitor reports for 2–4 weeks. - Review the DMARC reports in Mailnaptic (see Understanding DMARC Reports) to identify any legitimate senders failing authentication.
- Fix any issues, then move to
p=quarantine. - When reports stay clean, switch to
p=reject.
Common Parameters
rua— Address to receive aggregate reports (daily XML summaries).ruf— Address for forensic (failure) reports. Many ISPs do not send these.pct— Percentage of messages failing DMARC to which the policy is applied (0–100, default 100).adkim— DKIM alignment mode:r(relaxed, default) ors(strict).aspf— SPF alignment mode:r(relaxed, default) ors(strict).