Adding DMARC Records

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on top of SPF and DKIM. On its own, SPF says which servers may send for your domain, and DKIM cryptographically signs your messages. DMARC adds the final piece: it tells receiving mail servers what to do with mail claiming to be from your domain that fails those checks — and, optionally, sends you reports about it.

Those reports are the rua bit. Add a rua tag with your email — e.g. v=DMARC1; p=reject; rua=mailto:[email protected] — and inbox providers will email you daily aggregate reports listing who's sending mail as your domain and whether it passed SPF/DKIM. It's the best way to spot both spoofers and your own misconfigured senders, especially before tightening your policy.

In short: SPF and DKIM prove a message is legit. DMARC is the policy that decides what happens when a message isn't. That's what stops scammers from spoofing [email protected] to phish your customers.

The three DMARC policies

A DMARC record sets one of three policies via the p= tag:

Policy	What happens to mail that fails
p=none	Nothing — monitor only. Offers no protection on its own.
p=quarantine	Delivered to the spam/junk folder.
p=reject	Blocked outright. The strongest protection.

What we recommend

For most ImprovMX users, we recommend going straight to v=DMARC1; p=reject;. Here's why that's safe:

• Mail you send through ImprovMX SMTP is DKIM-signed with your own domain, so it passes DMARC and is never affected.
• Forwarded mail is not affected. Forwarding keeps the original sender's address, so it's governed by their domain's DMARC policy, not yours.

One thing to check first: if you also send mail as your domain through other services (a marketing tool, a CRM, Gmail's "send mail as", a website contact form) without setting up SPF/DKIM for them, p=reject will send that mail to spam or block it. If that's you, start with p=none to monitor, confirm every legitimate source passes, then switch to p=reject. If ImprovMX is your only sender, you can enable p=reject right away.

Want something fancier — a rua reporting address, p=quarantine, or other tags? Our DMARC Record Generator builds a custom record for you.

How to add a DMARC record

DMARC is a single TXT record on the _dmarc subdomain of your domain. Add this to your DNS provider:

Type	Name / Host	Value
TXT	_dmarc	v=DMARC1; p=reject;

Examples for some popular providers:

Example – Cloudflare

Go to your Cloudflare dashboard → Locate your domain → DNS tab → click Add Record:
• Type: TXT
• Name: _dmarc
• Content: v=DMARC1; p=reject;

Example – GoDaddy

Navigate to your domain → DNS Management → Add:
• Type: TXT
• Name: _dmarc
• Value: v=DMARC1; p=reject;
• Leave TTL at default

Example – Namecheap

Go to Domain List → Manage → Advanced DNS → Add New Record:
• Choose TXT Record
• Host: _dmarc
• Value: v=DMARC1; p=reject;

Wait for DNS Propagation

DNS changes can take up to 48 hours to propagate, but often update within a few minutes. You can check the status in your ImprovMX dashboard or with tools like ImprovMX Inspector.

Need Help?

If you're unsure about where to paste the record, reach out to your DNS provider's support team, or contact us at ImprovMX — we're happy to help.