DMARC step by step: from “monitor only” to real protection

What you'll achieve

• receive DMARC reports and understand what they say;
• find every service that sends email on behalf of your domain;
• move from p=none to p=quarantine and then to p=reject, without losing legitimate messages.

Before you start

• SPF and DKIM pass for messages sent from our server: in Enhance, under “Emails”, both show “Valid”.
• You have the list of services that send “from” your domain: your invoicing software, newsletter platform, online store, CRM, forms (see step 3 in Why my emails go to spam: SPF, DKIM, DMARC).
• Where your domain's DNS is: with us (the editor in Enhance, see DNS zone editor: A, CNAME, MX and TXT) or with another provider (make the same changes there).
• We use the English names from the Enhance interface, exactly as they appear on screen. If the panel opens in another language, switch it to English from the top right: “My account” » “Language”.

How to read a DMARC record

v=DMARC1; p=none; rua=mailto:dmarc@domeniul-tau.ro

• p= — the policy: none (monitor only), quarantine (send failing messages to spam), reject (reject them);
• rua= — the address where the big providers (Gmail, Outlook, Yahoo and others) send you daily reports: how many messages they saw “from” your domain, from which servers, and whether they passed the checks.

A message passes DMARC if it passes SPF or DKIM and the verified domain is the same as the one in “From”. An external service that signs with its own DKIM, not yours, can pass SPF and still fail DMARC.

The steps

A. Turn on the reports

1. In Enhance, create an address just for reports, for example dmarc@domeniul-tau.ro (see How to create an email account in Enhance). Reports are attachments, many of them and daily; don't mix them with your work email.
2. Open the DNS zone: “Websites” » the website » “Domains” » “Manage” next to the domain » “DNS records”.
3. Find the TXT record named _dmarc, click “⋯” » “Edit” and change “Value” to:

   v=DMARC1; p=none; rua=mailto:dmarc@domeniul-tau.ro

4. Click “Save”. The first reports arrive within 1–2 days.

B. Read the reports, 2–4 weeks

5. Reports are compressed XML files (.zip or .gz), one from each provider, per day. You can open them in a text editor, but a DMARC report analyzer makes it easier: there are online services, many with a free plan for a small domain.
6. For each server that appears in the reports, ask yourself: do I know it?
   • our server (server.nbt-host.com, address 185.230.138.193): your regular messages;
   • a service you use, but which fails: configure it (step 7);
   • a server you don't know: usually someone trying to send forgeries in your name. These are exactly what DMARC will stop.
7. For each known service that fails, add it to SPF and, above all, put its DKIM on your domain, with the record it gives you (steps in Why my emails go to spam: SPF, DKIM, DMARC, step 3). With DKIM on your domain, the service passes DMARC even after forwarding.

C. Tighten the policy

8. When the reports show that all your services pass, change the policy to quarantine:

   v=DMARC1; p=quarantine; rua=mailto:dmarc@domeniul-tau.ro

9. Keep watching the reports for another 2–4 weeks. If a legitimate service shows up with failing messages, fix it before you go further.

10. Then move to reject:

    v=DMARC1; p=reject; rua=mailto:dmarc@domeniul-tau.ro

    From now on, messages that claim to come from your domain and don't pass the checks are rejected by servers that honor DMARC.

D. Subdomains

11. The policy also applies to subdomains, unless they have their own DMARC. If a service sends from a subdomain (for example news.domeniul-tau.ro), check it separately in the reports.

If something doesn't work

• No reports arrive. Check with Dig (https://toolbox.googleapps.com/apps/dig/, type TXT, name _dmarc.domeniul-tau.ro) that the record has rua= and that the address exists. Some providers only send reports if they saw messages from you that day.
• You moved to quarantine or reject and a service no longer reaches customers. Go back to p=none, fix the service's SPF or DKIM, and start again from step 8.
• Automatically forwarded messages fail. Forwarding usually keeps the DKIM signature but breaks SPF. With DKIM enabled on the domain (we enable it on the main domain), messages still pass.
• The reports fill up the mailbox. Increase the space for the reports address or delete old ones after you have read them (see How much space you use and what takes it up).
• You have more than one _dmarc record. There must be only one. Delete the extra one.