Add a DMARC record

DMARC is one more DNS record for the domain you send from. It sits next to the SPF, DKIM and Return-Path records you added when you configured your DNS, and it takes a few minutes to add.

What DMARC does

SPF and DKIM let a receiving server check that an email really came from a sender you allow. DMARC ties those checks to the address in the From line, the one your recipients see, and says what to do when they fail:

• A policy. p=none only asks for reports, p=quarantine asks receivers to put failing mail in spam, and p=reject asks them to refuse it.
• Where to send reports (optional). With rua=mailto:..., receivers send daily summaries of the mail they saw from your domain and whether it passed.

Without a DMARC record, anyone can put your domain in the From line and receivers have no instructions from you. With one, they know your domain is managed and can trust the mail that passes.

Why you need it

• Gmail and Yahoo require a DMARC record from bulk senders and recommend it for everyone.
• Apple iCloud turns away most email from domains without one. The bounce reads 554 5.7.1 [HM08] Message rejected due to local policy. If your iCloud, me.com or mac.com recipients bounce with that message, a missing DMARC record is the most likely cause.
• Other providers use it as a sign that a domain is looked after, which helps your mail reach the inbox.

MailHawk signs your email with your own domain’s DKIM key, so once your DKIM record is verified your mail passes DMARC. MailHawk checks your DMARC record along with your other records, and emails you if a domain you send from has none.

Add the record

At the DNS provider of your sending domain, create one record:

• Type: TXT
• Name: _dmarc (the full hostname is _dmarc.example.com for example.com)
• Value: v=DMARC1; p=none;
• TTL: 3600, or your provider’s default

If your version of MailHawk shows a DMARC row when you click Configure under Tools > MailHawk > Domains, you can copy the Name and Value from there.

The same rules for the Name apply as for your other records. If you send from academy.example.com and edit the example.com zone with relative names, enter _dmarc.academy. A subdomain is also covered by its parent domain’s record: if _dmarc.example.com exists, academy.example.com already has DMARC and needs nothing more.

Already have a DMARC record?

Keep it. A name can only have one DMARC record, and two records starting with v=DMARC1 make both invalid. Any policy works with MailHawk once your DKIM record is verified, so there is no need to change it to p=none.

If your record uses p=quarantine or p=reject, make sure every other service that sends as your domain (your mailbox provider, a newsletter tool, a help desk) is authenticated too, or its mail will be filtered.

Choosing a policy

Start with p=none. It satisfies the providers above and never stops any of your email. To see which services send as your domain, add a reporting address, for example v=DMARC1; p=none; rua=mailto:dmarc@example.com;. Reports arrive as attachments every day from each provider, so use a mailbox set aside for them or a DMARC reporting service.

Once the reports show that all of your legitimate mail passes, you can move to p=quarantine and later p=reject to protect your domain from spoofing. Do that only when you are sure, because a stricter policy affects every service that sends as your domain, not just MailHawk.

Check it

DNS changes usually show up within minutes, but can take up to 24 hours. MailHawk checks your records every hour, and again when you click Verify on the domain’s Configure screen. To look it up yourself, search for the TXT record of _dmarc.yourdomain.com in any DNS lookup tool.