How can I create a DMARC record in DNS with Palisade?

Creating a DMARC record protects your brand by telling receiving mail servers how to treat messages that fail authentication — and by giving you reports on everyone sending mail as your domain. Below is a quick-fire Q&A that walks the whole process, from what the record does to publishing it in DNS and confirming it's live.

What does a DMARC record do?

It tells receiving mail servers how to handle messages that fail authentication checks. By publishing a single TXT record, you instruct servers to reject, quarantine, or simply monitor mail that isn't proven to come from you. That closes the gap SPF and DKIM leave open on their own: neither, by itself, protects the visible From: address a recipient actually reads. DMARC ties their results to that address, cutting phishing and spoofing and — over time — improving your sender reputation.

Which DNS entry type is used for DMARC?

DMARC is stored as a TXT record at the sub-domain _dmarc.yourdomain.com. The record is a set of tag-value pairs that define the version, the policy, the reporting addresses, and the alignment settings receivers should apply.

What are the key tags in a DMARC record?

• v=DMARC1 — the version. Required, and must come first.
• p= — the policy: none, quarantine, or reject.
• rua= — where aggregate (summary) reports are sent, e.g. mailto:dmarc@yourdomain.com.
• ruf= — where failure/forensic reports are sent (support is uneven across receivers).
• sp= — an optional separate policy for sub-domains.
• adkim= / aspf= — alignment mode for DKIM and SPF (r relaxed or s strict).

A typical monitoring record looks like this: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start with p=none to monitor, and point rua to an email address you control.

One thing that changed in 2026: the DMARC standard was reissued as RFC 9989 (with RFC 9990 and 9991 for reporting), replacing the original RFC 7489. The old pct tag was removed — for a staged rollout you now publish t=y alongside an enforcing policy instead of pct=10. Records written the old way still parse, so nothing you publish today breaks. See what DMARCbis (RFC 9989) changes for the full breakdown.

How can I generate a DMARC record without writing code?

Use Palisade's free DMARC record generator. Pick a policy, add your reporting addresses, choose alignment modes, and it builds the exact TXT string — no manual syntax to get wrong.

What steps do I follow to publish the record?

• Log in to your DNS provider's console (e.g. Cloudflare, GoDaddy, Route 53).
• Create a new TXT record.
• Set the host/name to _dmarc (the provider appends your domain automatically — don't type the full domain twice).
• Paste the TXT value from the generator.
• Save, and allow time for propagation — usually minutes, occasionally up to 48 hours.

The TXT value comes from Palisade's free DMARC record generator.

How do I verify that the record is live?

Run Palisade's DMARC lookup tool. It queries public DNS and shows the exact record receivers see, so you can confirm the value published cleanly and the policy reads the way you intended.

What DMARC policy should I start with?

Begin with p=none (monitoring mode). It collects reports without affecting delivery, letting you find every legitimate source and fix alignment before you move to quarantine or reject. Skipping this step is the most common way to block your own mail.

How do SPF and DKIM relate to DMARC?

DMARC builds on both. It doesn't authenticate anything itself — it evaluates the results of SPF and DKIM and checks that whichever one passed aligns with your From: domain. DMARC needs only one of the two to pass and align, not both. Confirm each is working with Palisade's SPF checker and DKIM validator before you enforce.

Can I add a BIMI logo to improve brand visibility?

Yes. Once DMARC is at enforcement (quarantine or reject), you can publish a BIMI record pointing to your brand's SVG logo, which supporting inboxes display next to your mail. BIMI at enforcement is also a trust signal, not just decoration — see what BIMI is for the requirements.

How can I monitor DMARC reports?

Configure the rua tag with an address you control. Aggregate reports arrive as daily XML summaries of every source sending under your domain, with pass/fail counts. Palisade parses that XML into a dashboard that highlights failing senders, so you're reading a source list instead of raw markup. For a walkthrough of what those reports contain, see how to understand DMARC reports.

What are the next steps after monitoring?

Review the reports, tighten SPF and DKIM until every legitimate sender aligns, then move the policy in stages: none → quarantine → reject. If you want a safety net during the move, publish t=y so receivers report on — but don't yet act on — the stricter policy. This phased approach is what keeps legitimate mail flowing while you close the door on spoofing. For the full rollout, see how to create a DMARC record.

Common issues with publishing a DMARC record

Why does my lookup still show "no DMARC record found"?

Almost always a host-name mistake. The record must live at _dmarc.yourdomain.com, so the host field should read exactly _dmarc — not the full domain, and not _dmarc.yourdomain.com.yourdomain.com (which happens when you type the domain into a field that already appends it). Re-check the host, save, and re-run the DMARC lookup. Propagation lag is the other cause: give it up to a few hours before assuming it failed.

Why is my DMARC record being ignored even though it's published?

Check the syntax. v=DMARC1 must be the first tag, tags are separated by semicolons, and reporting addresses need the mailto: prefix (rua=mailto:dmarc@yourdomain.com, not rua=dmarc@yourdomain.com). A stray smart-quote pasted from a document, or two DMARC records on the same host, will also make receivers skip it — there must be exactly one.

Why are legitimate emails failing DMARC after I turned on enforcement?

You moved off p=none before every sender aligned. A source can pass SPF or DKIM yet still fail DMARC if the authenticated domain doesn't match your visible From: domain — common with marketing platforms that sign with their own domain. Drop back to p=none, read the aggregate reports to find the misaligned source, fix its SPF/DKIM (or DKIM alignment), then re-enforce.

Why aren't I receiving any DMARC reports?

Confirm the rua address exists and can receive external mail, and that you used mailto:. If you're collecting reports at a domain other than the one being monitored, that receiving domain needs an authorization record too. Most missing-report cases are simply a typo in the rua value — verify it in the lookup tool.

Related reading

• Get to p=reject: the full enforcement guide
• What are DMARC, DKIM, and SPF?
• How to create a DMARC record
• How to understand DMARC reports

Ready to secure your email? Check your DMARC security score now and let Palisade guide you through the setup.