Once SPF and DKIM are in place for your domain, DMARC is the final piece that ties them together. This guide explains what DMARC is and how to create a DMARC record for your domain.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do when a message claims to be from your domain but fails both SPF and DKIM checks — and it lets you receive reports about those failures.
Without DMARC, a receiving server that sees a failed SPF/DKIM check has to make its own guess about whether to deliver, quarantine, or reject the message. DMARC removes the guesswork by letting you explicitly define that policy, and gives you visibility into who is sending mail using your domain — including any spoofing attempts.
How to Set Up DMARC
- Log in to your hosting control panel at https://iwx41.crservers.com:2443/siteworx/, or go to your Client Area, open your hosting service, and click Hosting Control Panel to log in automatically without a password.
- From the main menu, go to Administration > Mail Options > DMARC. This opens the DMARC Management page.
- Click + or Add.
- Select your domain from the dropdown and click Continue.
- Fill in the record fields (see recommended settings below) and click Save.
Recommended settings for getting started
DMARC has many optional fields, but most domains should start with a conservative, "monitor only" policy before tightening enforcement. We recommend:
- Policy: None (monitor only — nothing is rejected or quarantined yet)
- Subdomain Policy: None
- DKIM Mode: Relaxed
- SPF Mode: Relaxed
- Percentage: 100
- Report Interval: 86400 (daily)
- Report Format: AFRF
- Send Aggregate Email Reports To: an address you check regularly, e.g.
[email protected]
This setup won't affect delivery of any mail, but will start sending you a daily summary of every server sending email using your domain — legitimate or not. Review those reports for a few weeks, and once you're confident all your real mail sources (our servers, and any external provider you use) are passing, you can move to a stricter policy:
- Quarantine: Messages that fail are sent to the recipient's spam folder instead of being delivered normally.
- Reject: Messages that fail are rejected outright. Only move to this once you're fully confident nothing legitimate will be affected.
How to Verify It's Working
- In your control panel, go to Hosting Features > Domains > DNS Records and confirm you see a new TXT record at
_dmarc.yourdomain.com. - After a day or two at Policy = None, check the inbox you specified for aggregate reports — you should start receiving daily XML report emails from major providers like Google and Microsoft.
Common Issues
- DMARC record not saving / error about missing SPF or DKIM: double-check that both an SPF record and an active (non-testing) DKIM key already exist for the domain first.
- Legitimate mail starts getting quarantined after tightening the policy: this usually means a mail source (e.g. a marketing tool, CRM, or external provider) sending on your behalf isn't covered by your SPF/DKIM setup yet. Review your aggregate reports to identify it, then update SPF to include it before tightening DMARC further.
- Not receiving aggregate reports: some providers only send reports periodically or only report meaningful volume — give it a few days, and double check the reporting address doesn't have a mailbox filter silently discarding them.
Need Help?
Interpreting DMARC aggregate reports can be tricky the first time. If you'd like help reviewing yours before tightening your policy, open a support ticket and our team will assist.