Skip to main content

​
Implementing DMARC

DMARC helps protect your domain from being used in phishing attacks and improves email deliverability by giving mailbox providers confidence that your emails are legitimate.

​
Prerequisites

Since DMARC relies on DKIM and SPF, first ensure your existing emails are passing these checks:
  • DKIM verifies the email wasn’t altered in transit using cryptographic authentication
  • SPF authorizes IP addresses to send email for a domain
If you have a verified domain with Sequenzy, your emails are already passing SPF and DKIM.

​
What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that instructs mail servers what to do if an email message fails SPF and DKIM, preventing email spoofing (forged headers). DMARC is added to a domain through a TXT record at _dmarc. By preventing spoofing, a domain can build trust with mailbox providers, as it allows them to verify that emails are authorized to send on behalf of that domain. An email must pass either SPF or DKIM checks (but not necessarily both) to achieve DMARC compliance and be considered authenticated. A message fails DMARC if both SPF and DKIM fail.

​
Implementing DMARC

​
1. Add a TXT _dmarc Record

To start, add a flexible DMARC record to your domain: This record specifies a few parameters (see Reference section for more details):
  • v - Version: The version of DMARC
  • p - Policy: Tells the inbox how to process messages that fail DMARC. Options are none, quarantine, reject. It’s best practice to use quarantine or reject, but only do so once you know your messages are delivering and fully passing DMARC.
Once you’ve added a basic record, you should set up DMARC reporting to monitor your results.
To ensure you don’t accidentally introduce breaking changes to your email sending, we suggest starting with a policy of p=none; before moving to a stricter policy.

​
2. Test to Confirm Delivery and Passing

To test emails, send an email from all the applications and services your domain uses. Confirm that the messages are delivered to the inbox and that the headers show DMARC passing. Spend a few days at this step to ensure you’re checking all sources of email from your domain and catch email that is sent at a different cadence than daily. To confirm DMARC passed, you can inspect the email headers and confirm there is dmarc=pass.
Gradually identify email sources using tools like Google Postmaster Tools, which provides DKIM/SPF feedback. DMARC monitoring services can aggregate your email sources by collecting DMARC reports, helping you discover any services sending email on your domain’s behalf.

​
3. Upgrade Policy

Once you have verified DMARC is passing across all your sending, you should upgrade your policy to p=quarantine;. This policy gives mailbox providers greater confidence in your domain since your domain only allows authenticated email.
Once your policy is p=quarantine; or p=reject;, you can explore setting up BIMI (Brand Indicators for Message Identification), which can provide established brands even greater sending credibility by displaying a logo as an avatar in an email client.

​
DMARC Reporting

DMARC includes a reporting mechanism via the rua parameter, which tells mailbox providers where to send aggregate reports about emails from your domain. These reports are XML files that show which IP addresses are sending email on your behalf and whether those emails pass SPF and DKIM.

​
Why you need a monitoring service

Raw DMARC reports are XML files sent as email attachments — they’re not meant to be read directly. To get value from DMARC reporting, you should use a free monitoring service that parses these reports into a readable dashboard.
  • EasyDMARC — free tier with a dashboard that visualizes your DMARC data, shows sending sources, and highlights failures.
  • URIports — free DMARC report monitoring with a clean dashboard and real-time alerts.
  • DMARC Analyzer (Mimecast) — free analysis tools with detailed reporting.

​
How to set it up

  1. Sign up for a DMARC monitoring service
  2. The service will give you a reporting address (e.g., abc123@ag.easydmarc.com)
  3. Add rua to your DMARC record pointing to that address:
Don’t point rua at your own email address (e.g., dmarc@yourdomain.com). You’ll receive raw XML files that are difficult to interpret without specialized tooling.
Reports typically arrive daily. Give it a week or two to collect enough data before making policy decisions.

​
Reference

While the DMARC protocol includes both pct and ruf parameters, they are not widely followed by mailbox providers. These settings may not be respected or followed.

​
When Sequenzy Requires DMARC

Domains created with Sequenzy’s unified DNS record set must have exactly one valid v=DMARC1 record before verification can complete. Sequenzy checks the sending domain first and then its organizational domain, so a policy already published for example.com can cover a sending subdomain such as mail.example.com. Existing domains with the legacy Amazon SES record set are not migrated and keep DMARC as an advisory check. Their sending remains available if DMARC is missing, but the dashboard continues to report the issue. In both cohorts:
  • DMARC applies to all mail from the domain, not only Sequenzy mail.
  • Do not publish multiple DMARC records; multiple policies are invalid.
  • Sequenzy accepts any valid policy. Start with p=none if you need to observe all sending sources before moving to quarantine or reject.

Domain Verification

Set up your sending domain with DNS records

Transactional Emails

Send triggered emails via API