Ask someone else to make the change
On every plan
Many people who read DMARC reports cannot change their own DNS, their website or their email platform. Each message below is written to be sent as it is. Fill in the parts in square brackets, and send it. For the first message, the domain's Records page writes the whole thing for you, with the domain's own records in it, and a Copy the message button.
To whoever runs your DNS
Use the message on the domain's Records page, not the example here. It carries the value that page tells you to publish: a new record, the merged value when the domain already has a DMARC record, or the record you built there. It also says to delete every DMARC record at the name and publish one, when there are several. The example below is what it looks like for a domain with no DMARC record yet. When the value carries p=quarantine or p=reject, the first paragraph says what that does to mail that fails the check, and that you have prepared for it, instead of saying nothing changes.
Hello,
We need DNS records for example.com. They only ask mailbox providers to send us reports, and they do not change how our email is delivered.
Please add this TXT record.
Name: _dmarc.example.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:k3x9p2m7q4w8@rep.mailmoni.com
Please also add this TXT record.
Name: _smtp._tls.example.com
Type: TXT
Value: v=TLSRPTv1; rua=mailto:k3x9p2m7q4w8@rep.mailmoni.com
Tell me when they are published, so I can check them.
Thank you.
Your reporting address on the page is the one for your domain. Never copy the one in this example. When they tell you it is done, press Check now on the domain's DNS page. Publish your DMARC record explains what each tag does.
To your web agency
A website often sends mail as your domain: a contact form, an order confirmation, a booking reminder. The reports list it as a source, and when it fails the check, only the agency can fix it. Send this when a source on the domain's Sources page belongs to your website.
Hello,
Our website sends email that uses example.com as the sender, for example from the contact form: [describe the mail, such as "the contact form" or "order confirmations"].
We are checking which services send email as our domain, and this one fails the check. Please tell me:
1. Which service or server sends this email.
2. Whether it can send through our email platform, [name of the email platform], instead of sending directly from the web server.
3. If it cannot, whether it can sign its email with our own domain, example.com, and which setting does that.
Please do not change the sender address of the email without telling me first.
Thank you.
Fix a source that fails DMARC shows how to find out which service the source is.
To your email platform's support
A mailing tool or a helpdesk signs its email with its own domain by default. DMARC then does not count the signature as yours. Ask the platform's support to sign with your domain instead. Many platforms call it a custom domain, a branded domain or domain authentication.
Hello,
We use [name of the platform] to send email as example.com. Please help us set up DKIM signing with our own domain, so that the signature's domain is example.com and not a domain of yours.
Please send me:
1. The DNS records we need to add, with the name, type and value of each.
2. The steps to turn the signing on, once the records are published.
3. Whether our account's plan includes this.
Thank you.
When the platform sends you the records, forward them to whoever runs your DNS with the first message above. The new DKIM signature shows in the reports as passing for your domain once the platform sends with it.
To your staff before a stricter policy
Before you move to p=quarantine, anyone who sends email as your domain should hear about it. Mail that fails the check then goes to spam. Send this well before the change, to everyone who might send as the domain from a tool the reports do not show.
Hello,
On [date] we are changing how mailbox providers treat email that claims to come from example.com and cannot prove it. Mail that fails the check will usually be sent to spam.
If you send email as example.com from any tool other than our own mail system, such as a newsletter service, a shop, a helpdesk or a booking system, tell me by [date]. I need to add it to our list before the change.
If an email you sent goes missing or lands in spam after [date], tell me the same day, with the time and the recipient.
Thank you.
Move to a stricter DMARC policy says when the domain is ready. Wait at least 14 days after the last change before the next one.
Published 27 October 2026 · Checked 27 October 2026