How to set up DMARC
If the checkup says your domain has no DMARC record, this is the fix. It is one line of text in your DNS settings, and you can add it yourself in about ten minutes.
What DMARC is, in plain English
Anyone can put your business name and email address in the "From" line of a message. DMARC is a short public note, published with your domain, that tells Gmail, Outlook and every other mail system what to do when a message claims to be from you but fails the checks that prove it really is. It also asks those systems to send you reports, so you can see who is sending mail in your name.
DMARC sits on top of two other records. SPF lists who is allowed to send for your domain. DKIM adds a signature to each message. DMARC ties them together. Google and Yahoo have required a DMARC record from bulk senders since 2024, and Microsoft followed for Outlook.com in 2025, so even a small business is better off having one.
Start gentle: p=none with a report address
The safe first step is a DMARC record that only watches and reports. It does not block or quarantine anything, so it cannot break your email. Here is the record:
| Type | TXT |
|---|---|
| Name (or Host) | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
| TTL | Leave the default |
Replace dmarc@yourdomain.com with a real mailbox on your own domain that you can check. A shared address like dmarc@ or a folder rule works well, because the reports arrive as zipped XML files that are not fun to read in your main inbox.
_dmarc, edit that one instead of adding a second. Two records means neither one counts.One more thing before you start: make changes where your domain's DNS actually lives. If you bought the domain at GoDaddy but your website company moved the nameservers to Cloudflare, your records belong in Cloudflare. The checkup report shows your nameservers if you are not sure.
GoDaddy DNS
- Sign in to GoDaddy and open your domain list (Domain Portfolio).
- Pick your domain and open its DNS settings.
- Add a new record. Choose type TXT.
- Fill it in. Name:
_dmarc. Value: your record from above. Leave the TTL as it is. - Save. GoDaddy adds your domain name to the end of the Name for you, so do not type the full
_dmarc.yourdomain.com.
Cloudflare
- Sign in to Cloudflare and select your domain.
- Open DNS, then Records, and choose Add record.
- Type TXT, Name
_dmarc, and paste your record into Content. - Save. TXT records are not proxied, so there is no orange cloud to worry about here.
Squarespace, Wix and other domain hosts
Every domain host has a place to add custom DNS records, though the menu names vary. Look for words like "DNS settings", "Manage DNS records" or "Custom records" inside the domain section of your account. Then add the same thing: a TXT record, host or name _dmarc, with your record as the value.
A few hosts want the full name (_dmarc.yourdomain.com) instead of just _dmarc. If the form shows your domain name next to the field already, type only _dmarc. If you are unsure, add it, wait a little, and run the checkup again. It will tell you whether the record is visible.
Read the reports for a few weeks
Over the next few weeks, mail systems will send reports to your rua address. They show every service sending mail as your domain and whether it passed SPF and DKIM. This is where you discover the newsletter tool, the booking system or the copier that sends scans by email. Each legitimate sender needs to pass before you tighten anything. A free DMARC report viewer can turn the XML files into a readable list if you would rather not open them by hand.
Tighten it once SPF and DKIM pass
When the reports show your real senders passing, move the policy up in two steps. Edit the same record and change only the p= part:
- Quarantine:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com. Mail that fails goes to spam instead of the inbox. Watch the reports and your own inbox for a couple of weeks. - Reject:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com. Mail that fails is refused. This is the setting that actually stops someone from sending convincing fake invoices in your name.
Do not jump straight to reject on day one. If a real sender is not set up yet, its mail will disappear, and you will find out when a customer says they never got your invoice.
DMARC questions
Will adding DMARC break my email?
Not with p=none. That setting only asks for reports. Problems come from tightening to quarantine or reject before every real sender passes SPF or DKIM, which is why you read the reports first.
How long until the checkup sees my new record?
Often within minutes, sometimes longer, depending on your DNS host. If the checkup still shows no record after a few hours, double-check the name is exactly _dmarc and that you edited DNS where your nameservers point.
Can I send reports to an outside service?
Yes. Many DMARC report services give you a rua address on their own domain. Use the exact address they give you, since a report address on another domain needs a matching permission record on that domain, which those services already have.
Made the change? Run the checkup again.
The free checkup reads your DMARC, SPF and DKIM records and tells you in plain English what still needs attention.