Skip to content

DMARC setup for gmail

Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) for Gmail involves creating a DMARC record in your domain's DNS. This helps you monitor and enforce policies for emails sent from your domain, ensuring they align with SPF and DKIM authentication.

Step 1: Ensure SPF and DKIM Are Set Up

Before setting up DMARC, make sure: * SPF is configured to authorize Gmail to send emails on behalf of your domain. * DKIM is set up for Gmail with a valid public/private key pair and DNS record.

Step 2: Log in to DNSmadeeazy

  1. Navigate to the aholadigital.com DNS records.

Step 3: Create a DMARC Record

  1. Add a New DNS TXT Record:
    • Name/Host: _dmarc (e.g., _dmarc.example.com).
    • Type: TXT
    • Value: This specifies your DMARC policy. Use the following as a starting point:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-failures@example.com
    • Explanation of Key Fields: * v=DMARC1: Indicates this is a DMARC record. * p=none: Specifies the DMARC policy (explained below). * rua: Email address for aggregate reports (sent daily with overall authentication results). * ruf: Email address for forensic/failure reports (detailed reports about individual failed messages).
    • TTL (Time to Live): 3600 seconds (or your DNS provider’s default).
  • Policy Options:
    • p=none: Monitor emails without taking action (recommended for the initial setup).
    • p=quarantine: Send unauthenticated emails to spam/junk folders.
    • p=reject: Block unauthenticated emails completely (use this after monitoring and testing).

Step 4: Publish the DMARC Record

Save the new DNS TXT record. It may take a few minutes to 48 hours for DNS propagation.

Step 5: Verify the DMARC Setup

  1. Use online tools like:
  2. Send test emails and verify the Authentication-Results in the email headers to confirm DMARC is being evaluated.

Step 6: Monitor DMARC Reports

  • Aggregate Reports (rua):
    • These are XML files sent by mail providers summarizing the alignment of SPF and DKIM for emails sent from your domain.
    • Use tools like DMARCian or Postmark’s DMARC Parser to analyze these reports.
  • Failure Reports (ruf):
    • Detailed reports sent when specific emails fail authentication.

Step 7: Enforce DMARC Policies

  1. After monitoring for a few weeks and resolving any issues:
    • Change the policy to p=quarantine to send unauthenticated emails to spam/junk folders.
    • Finally, move to p=reject to block unauthenticated emails entirely.
  2. Update reports (rua and ruf) as needed to ensure continued monitoring.

Example DMARC Record for Strict Enforcement

Once you’re confident about SPF and DKIM alignment, switch to a stricter policy:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-failures@example.com; fo=1; sp=reject

Explanation of Additional Fields: * fo=1: Requests failure reports for all alignment issues. * sp=reject: Applies the same policy to subdomains.

By setting up DMARC, you gain greater control over your domain's email security, reducing the risk of phishing and spoofing.