A DMARC record is a DNS entry that tells email providers like Gmail and Outlook what to do with messages sent from your domain that fail SPF or DKIM checks: deliver them anyway, send them to spam, or reject them outright. It also lets you receive reports showing who is sending email using your domain name, including anyone trying to spoof it.
What You Need Before You Start
DMARC builds on SPF and DKIM rather than replacing them. Make sure both are already set up for your domain first, otherwise DMARC has nothing reliable to check against.
If you haven't set up SPF and DKIM yet, do that first. See How to Set Up SPF and DKIM Records to Stop Your Emails Going to Spam.
What the DMARC Record Looks Like
A DMARC record is a TXT record added at a specific hostname on your domain. For a domain like yourbusiness.co.ke, the record looks like this:
- Host/Name: _dmarc.yourbusiness.co.ke (or just _dmarc, depending on how your DNS editor expects it)
- Type: TXT
- Value: v=DMARC1; p=none; rua=mailto:you@yourbusiness.co.ke
Replace the email address in rua=mailto: with an inbox you actually check. That address is where DMARC reports get sent.
How to Add the Record
In cPanel
- Log in to cPanel and open Zone Editor under the Domains section.
- Find your domain in the list and click Manage.
- Click Add Record and choose TXT Record.
- In the Name field, enter _dmarc (cPanel usually appends your domain automatically).
- In the Record field, paste your DMARC value, e.g. v=DMARC1; p=none; rua=mailto:you@yourbusiness.co.ke.
- Click Save Record.
In DirectAdmin
- Log in to DirectAdmin and open DNS Management under the Domain Setup section.
- Select the domain you want to update.
- In the TXT Records section, enter _dmarc as the name.
- Enter your DMARC value in the record field, e.g. v=DMARC1; p=none; rua=mailto:you@yourbusiness.co.ke.
- Click Add to save the record.
Choosing a Policy
The p= part of the record is your policy, and it controls how strict DMARC is:
- p=none: Monitor only. Nothing gets blocked, but you start receiving reports. This is the safest starting point.
- p=quarantine: Messages that fail the check are sent to the recipient's spam folder.
- p=reject: Messages that fail the check are rejected outright.
Start with p=none for a few weeks and review your reports before moving to quarantine or reject. Switching straight to reject can block legitimate email if your SPF or DKIM setup has a mistake you haven't caught yet.
Checking It's Working
DNS changes can take a few hours to propagate fully, so give it some time before testing. Once it has propagated, send a test email to an external Gmail or Outlook address and check the message headers, or use any DNS lookup tool to query the TXT record at _dmarc.yourdomain.com and confirm it returns the value you set.