How do I create a DMARC record?

DMARC (Domain-based Message Authentication, Reporting & Conformance) helps prevent attackers from using your domain to send spoofed or phishing emails.

The standard one.com DMARC record is enabled automatically for new domains. If it isn't enabled for your domain, you can enable it in your DNS settings. DMARC helps protect your domain against email spoofing, but it cannot prevent spoofing completely because not all receiving mail servers check DMARC records. If you need a different DMARC policy or reporting setup, you can create a custom DMARC record instead.

How do SPF, DKIM and DMARC work together?
DMARC policies explained
DMARC policies explained
DMARC email reports
Add a custom DMARC record
Optional: Add RUF reports

New one.com Control Panel update

With the rollout of our new Control Panel design, some steps or screenshots in this guide may look different from what you see now. While we work on updates, please check the guide below whenever the instructions don't match your screen:

Navigating the new one.com Control Panel design

How do SPF, DKIM and DMARC work together?

SPF, DKIM and DMARC are three email authentication methods that work together to help protect your domain against spoofing and phishing.

DMARC also allows you to receive reports about your domain’s email activity, so you can monitor and improve your email security.

SPF vchecks whether an email was sent from a mail server that is authorised to send email for your domain.
DKIM signs outgoing emails with a cryptographic signature, allowing receiving mail servers to verify that an authorised server sent the email and that the email hasn’t been altered or modified in transit. DKIM is handled automatically by one.com when you use one.com’s nameservers, so you don’t need to configure it yourself. If you use external nameservers, additional configuration may be required for DKIM to work. Contact our support team for help with the required setup. Receiving mail servers can use this signature to check that the email really came from your domain and wasn't changed after it was sent. mail servers to verify the email.
DMARC uses the results of SPF and DKIM to check whether an email is authenticated and whether the authenticated domain matches the domain shown in the From address. It also lets you specify how receiving mail servers should handle emails that fail these checks.

An email can pass DMARC when SPF and DKIM pass and are correctly aligned with the domain in the From address.

Together, SPF, DKIM and DMARC make it more difficult for someone to send fraudulent emails that appear to come from your domain.

Enable the standard one.com DMARC record

The standard one.com DMARC record is enabled automatically for newer domains. If it isn't enabled for your domain, you can enable it from your DNS settings:

Log in to the one.com Control Panel.
In the menu on the left, go to Domains DNS settings.
Select DNS records.
Under Standard DNS settings, select Show all.
Find TXT _dmarc.domain.com.
Enable the toggle for TXT _dmarc.domain.com.

The screenshot shows an example of adding a TXT record for DMARC in the DNS Administration.

Your standard one.com DMARC record is now enabled. It can take up to 90 minutes before the DNS change is active.

DMARC policies explained

A DMARC policy tells receiving mail servers how you want them to handle emails that fail DMARC.

There are three DMARC policies:

none - Monitoring only. No specific action is requested for emails that fail DMARC.
quarantine - Requests that failed emails are treated as suspicious, for example by placing them in the spam folder.
reject - Requests that failed emails are rejected.

If you're setting up a custom DMARC record, it's usually best to start with p=none while checking that legitimate emails from your domain pass DMARC. You can then move to p=quarantine or p=reject when you're confident that your email authentication is configured correctly.

DMARC email reports

custom DMARC record can include an email address where you receive reports about emails sent using your domain. There are two types of DMARC reports:

RUA reports provide an aggregated overview of email activity for your domain, including SPF, DKIM and DMARC authentication results.
RUF reports provide more detailed information about individual emails that fail DMARC.

Not all email providers send DMARC reports, so you may not receive reports for every email.

If you want to receive DMARC reports, we recommend using a dedicated email account on your domain, for example dmarc-reports@yourdomain.com. DMARC reports are generated for automated processing and are not intended to be read manually. We also recommend disabling spam filtering for this email account to make sure the reports are received.

Add a custom DMARC record

If you need a different DMARC policy or reporting setup, you can create a custom DMARC record.

When you create a custom DMARC record, the standard one.com DMARC record is disabled automatically. Your domain should only have one DMARC record.

A basic custom DMARC record with aggregate reporting looks like this:

Hostname: _dmarc 

Value: v=DMARC1; p=policy; rua=mailto:an-email-address 

TTL: Leave this field empty to use the default value.

Replace policy with none, quarantine or reject, and replace an-email-address with the email address where you want to receive DMARC reports.

To add the custom DMARC record:

Log in to the one.com Control Panel.
In the menu on the left, go to Domains DNS settings.
Select DNS records.
Under Create new record, select TXT.
Enter _dmarc in the Hostname field.
Enter your custom DMARC record in the Value field.
Leave TTL empty unless you need a specific value.
Select Create record to save your settings.

Your custom DMARC record is now added, and the standard one.com DMARC record is disabled automatically. It can take up to 90 minutes before the DNS change is active.

Optional: Add RUF reports

If you need detailed reports about individual emails that fail DMARC, you can add the optional ruf tag to your custom DMARC record.

For example:

v=DMARC1; p=none; rua=mailto:an-email-address; ruf=mailto:an-email-address

RUF reports may contain information from individual emails, including message headers or parts of the original message. They are mainly useful for advanced troubleshooting, and not all receiving mail servers send them.

Related articles:

Was this article helpful?