Start free
Menu
In this section

Getting started

Publish your DMARC record

On every plan

Add one TXT record at _dmarc under your domain. Its value starts with v=DMARC1; p=none and names your reporting address in rua. The domain's Records tab builds the exact record for you, with buttons to copy its name and value. If the domain already has a DMARC record, read if the domain already has a DMARC record first.

What the record looks like

For a domain with no DMARC record yet, the record looks like this:

Name:   _dmarc.example.com
Type:   TXT
Value:  v=DMARC1; p=none; rua=mailto:k3x9p2m7q4w8@rep.mailmoni.com

The address after mailto: is the domain's reporting address. Each domain has its own, a random string of letters and digits followed by @rep.mailmoni.com. Copy yours from the Records tab, not from this example.

p=none blocks nothing. Your mail is delivered as before, and mailbox providers start sending you reports about it. You tighten the policy later, once the reports show who sends email as your domain.

Where to find it

Open the domain, then its Records tab. It shows the DMARC record and the TLS-RPT record, each with its name and value. Every member of the organization can open the tab.

Until the domain is verified, its Home tab also shows the shortest DMARC record that works, v=DMARC1; p=none; rua=mailto: and your address.

If the domain already has a DMARC record

A domain has one DMARC record. If there are two at _dmarc, mailbox providers treat that as no record at all. So change the record you have, and do not add a second one.

The Records tab reads your current record from our last DNS check of the domain. We check a new domain's DNS as soon as you add it, so the tab finds a record you already have. If you changed the record since, press Check now on the DNS tab before you build the record. The Records tab then starts from the record you have:

  • Your policy and your other tags stay as they are.
  • Report addresses already in rua stay, and yours is added after them.
  • The tab lists each change, such as "rua: … becomes …", "ruf: … is added" or "sp: … is removed".
  • ri and rf, which RFC 9989 retired, are left out, and the tab says so for each.
  • A tag whose value is not valid, or an address in rua or ruf that is not valid, is left out on its own, and the tab says so.
  • A record that sets a tag more than once, or has a part with no tag name, is merged from what can be read. A repeated policy keeps the strictest value, so it is never lowered, and every report address stays. The tab names what it leaves out.
  • A record whose version is wrong, or that does not start with v=DMARC1, is not merged. The tab says so, and publishing the new record replaces it.

When you check the domain on its Home tab before it is verified, and its DMARC record sends reports elsewhere, the tab says so and shows the same record with your address added. Publish that value in place of the old one.

The settings you can change

A form beside the record sets each tag. It starts from your current record, or from these defaults. A tag at its default is left out of the record, because it means the same, unless your current record spells it out. Tags the form does not set, such as np and psd, stay as your record has them.

Tag What it sets Default
p What mailbox providers do with mail that fails DMARC: none, quarantine or reject none
sp The same for subdomains the same as p
pct The share of failing mail the policy applies to, in percent 100
adkim DKIM alignment, relaxed or strict r, relaxed
aspf SPF alignment, relaxed or strict r, relaxed
fo When a forensic report is sent 0, when both SPF and DKIM fail
t Test mode, t=y: mailbox providers that follow RFC 9989 apply the next lower policy, quarantine for reject and none for quarantine. Others ignore t. off
ruf Forensic reports to your reporting address off

Start at p=none and leave the rest as they are. Relaxed alignment is right unless you know you need strict.

If the domain has no reports yet and you choose quarantine or reject, the tab warns you: mail from any service you have not set up goes to spam or is refused. Readiness says when the reports show the domain is ready.

Publish the TLS-RPT record beside it

The same tab builds a second TXT record:

Name:   _smtp._tls.example.com
Type:   TXT
Value:  v=TLSRPTv1; rua=mailto:k3x9p2m7q4w8@rep.mailmoni.com

With it, mailbox providers report when they cannot open an encrypted (TLS) connection to your mail servers. The reports go to the same reporting address. If the domain already has a TLS-RPT record, its addresses stay and yours is added.

Add the records at your DNS host

If the domain's DNS is at Cloudflare, connect Cloudflare and we write both records for you. Anywhere else, create a TXT record at your DNS host for each one, and copy in the name and value exactly. Then press Check now: on the domain's Home tab while the domain is not verified, which verifies it, and on its DNS tab after that.

If someone else manages your DNS, such as the agency that built your website or your IT contact, send them the name and value of both records.

Next, if your DNS is at Cloudflare, publish the records through Cloudflare. Otherwise, go on to verify that the domain is yours.

Published 27 October 2026 · Checked 27 October 2026