Inbox check guide
How to set up DMARC: a safe path from p=none to quarantine
Reviewed
Short answer
Add a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Make sure SPF and DKIM pass for every service that sends as you, read the daily reports for two to four weeks, then change p=none to p=quarantine. Only quarantine or reject actually stops others sending email in your name.
Check your domain now
Before you start
DMARC builds on SPF and DKIM: it tells inboxes what to do when a message claiming to be from your domain fails both. Set up SPF and DKIM first — the inbox check shows whether they pass.
Gmail and Yahoo require a DMARC record from bulk senders, and Microsoft requires one from high-volume senders to Outlook.com. A record with p=none meets those requirements but doesn’t protect you; it only reports.
Step 1: publish a monitoring record
Create a TXT record with the name _dmarc (your DNS host adds your domain automatically) and the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Use a mailbox that exists: reports arrive daily as attachments.
Where to add it
Menu names change, but these are the usual paths:
- GoDaddy: Sign in to GoDaddy → your domain → DNS → Add New Record.
- Cloudflare: Cloudflare dashboard → your domain → DNS → Records → Add record.
- Squarespace: Squarespace → Domains → your domain → DNS → DNS Settings → Add record.
- Namecheap: Namecheap → Domain List → Manage → Advanced DNS → Add New Record.
- IONOS: IONOS → Domains & SSL → your domain → DNS → Add record.
- STRATO: STRATO → Domains → Manage domain → DNS → manage the TXT and CNAME records.
- Wix: Wix → Domains → ⋯ next to your domain → Manage DNS Records → Add record.
- Hostinger: Hostinger hPanel → Domains → Manage → DNS / Nameservers → add a record.
- Amazon Route 53: AWS console → Route 53 → Hosted zones → your domain → Create record.
- Vercel: Vercel → Domains → your domain → DNS Records → Add.
- Hetzner: Hetzner DNS console → your zone → Add record.
Step 2: move to quarantine
When the reports show your own services passing — your mailbox provider, newsletter tool, shop, invoicing — change p=none to p=quarantine. Forged mail now goes to spam. Later, p=reject refuses it outright.
Common mistakes: two DMARC records (both are ignored), a report address that doesn’t exist, and enforcing before a sending service is authenticated, which sends your own invoices to spam.