Short answer: a DMARC record is a TXT record at _dmarc. It tells other mail providers what to do when a message uses your domain but fails SPF or DKIM. If you do not already have one, start with monitoring:
| Type | Host / name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; |
p=none does not block mail. Receivers still deliver the message. The record says you are watching the results while you confirm that real mail from the domain is passing SPF and DKIM. Move to a stricter policy only after legitimate mail is passing. A policy of quarantine or reject, set too early, can send your own quotes and invoices to junk, or bounce them.
Where the record goes
The host is _dmarc, not @ and not www. Some DNS panels want the host as _dmarc. Others want the full name, _dmarc followed by your domain. Both mean the same place, as long as the domain is not added twice. The value is a TXT record. It is published with the company that hosts your DNS, which may be HSJ Host or the company that already hosts the website. You do not need to change nameservers to add it.
Publish one DMARC record. If two TXT records exist at _dmarc, receivers can ignore them. Other TXT records on the domain, including SPF, stay where they are. DMARC does not replace them.
If a DMARC record is already there
Do not replace it just to match the table. Read the current value first. If it already has p=quarantine or p=reject, or an address that receives reports, leave it until you know why it was set. Add the record above only when _dmarc does not exist. Replacing a stricter policy with p=none turns that protection off. Replacing p=none with reject on the day you move mail can throw away legitimate messages.
Set the other records first
DMARC checks the results of SPF and DKIM. It has nothing useful to say until those exist. Use this order:
- Create the mailbox. The steps are in how to create an email account in cPanel.
- When you are ready for new mail to arrive here, set the MX record. Copy old mail across before that change.
- Publish one SPF record, and keep any other genuine sender inside that same record.
- Copy this domain’s DKIM record from cPanel under Email Deliverability, then Manage.
- Add
v=DMARC1; p=none;at_dmarconly if that name does not already have a record.
Send a new message to an outside address after DNS has updated and confirm SPF and DKIM pass. A stricter DMARC policy is a later decision, made when the mail you actually send is passing. The starter record does not include a reporting address. If you already have a policy that sends reports somewhere, leave that address in place.
What DMARC does not do
DMARC does not deliver mail. The MX record does that. A p=none record does not empty the junk folder, and it does not stop spam that was sent to you. It tells other providers how to treat messages that use your domain in the From address and fail the checks. Until SPF and DKIM pass for your real mail, the safe published policy is the monitoring record above, or the policy you already had.
DNS changes often show within an hour and can take 24 to 48 hours. For the hosting login, use the HSJ Host client portal. Do not send the account password by email. Phone support is available Monday to Friday, 9 am to 9 pm AEST/AEDT, on 1800 519 724. Support tickets can be submitted 24/7.