DMARC
Tell receiving mail servers how to handle messages that fail authentication — protecting your domain from spoofing.
DMARC lets you tell receiving mail servers how to handle messages that fail authentication checks for your domain — protecting your domain from being used in phishing and spoofing attacks.
How it works with eusend
DMARC passes when either DKIM or SPF is aligned with your sending domain — it doesn't require both. Because eusend signs every outbound email with your own DKIM key (set up during domain verification), DKIM alignment passes automatically. You can add a DMARC record to your domain straight away without any additional infrastructure changes.
Add a DMARC record
Add the following TXT record to your domain's DNS. Start with a p=none policy
so you can monitor results before enforcing anything.
| Type | Host / Name | Value |
|---|---|---|
TXT | _dmarc.acme.com | v=DMARC1; p=none; rua=mailto:dmarc@acme.com; |
Replace dmarc@acme.com with a real address you control. Receiving servers
send aggregate reports to this address — XML digests of authentication results
across all email from your domain, typically once a day.
Tightening the policy
Once you've confirmed your emails are passing DMARC (check the
Authentication-Results header in any received email, or wait for aggregate
reports), you can switch to a stricter policy:
| Policy | Effect |
|---|---|
p=none | No action taken. Reports are still sent. Use this while monitoring. |
p=quarantine | Failing messages go to spam. A good middle ground once delivery is confirmed. |
p=reject | Failing messages are bounced outright. Maximum protection. |
Only move to p=reject once you're certain all legitimate email from your
domain passes DKIM or SPF. Any service sending on your behalf — transactional
email, marketing tools, CRMs — needs to be authenticated before you enforce
rejection.