Article
Set up DMARC | Security & data protection
knowledge.workspace.google.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
DMARC alignment “DMARC passes or fails a message based on how closely the domain in the From: header matches the sending domain specified by either SPF or DKIM. This is called alignment.” You can choose from two alignment modes: strict or relaxed. You set the alignment mode for SPF and DKIM in the DMARC record using the aspf and adkim DMARC record tags.
DMARC passes or fails a message based on how closely the domain in the From: header matches the sending domain specified by either SPF or DKIM. This is called alignment. “You can choose from two alignment modes: strict or relaxed. You set the alignment mode for SPF and DKIM in the DMARC record using the aspf and adkim DMARC record tags.” Authentication method Strict alignment Relaxed alignment SPF An exact match between the domain in the Envelope-Sender (also called Return-Path or bounce) address and the domain in the header From: address. The domain in the header From: address must match or be a subdomain of the domain in the Envelope-Sender (also called Return-Path or bounce) address. DKIM An exact match between the relevant DKIM domain, and the domain in the header From: address. The domain in the header From: address must match or be a subdomain of the domain specified in the DKIM signature d= tag.
Before you begin “You must turn on SPF and/or DKIM for your domain before you can use DMARC.” To check if DMARC is already set up for your domain, use one of many free tools available on the internet. If DMARC is already set up, you should review your DMARC reports to check that DMARC is effectively authenticating messages and they are being delivered as expected.
Set up DMARC “DMARC tells receiving email servers what action to take on messages sent from your domain that don't pass SPF or DKIM authentication.” A DMARC record is a line of text that you add to your domain, following your domain provider's instructions. Here's an example DMARC record:
DMARC tells receiving email servers what action to take on messages sent from your domain that don't pass SPF or DKIM authentication. The action options are reject, quarantine, or deliver the message. You can also get reports that help you identify possible authentication issues and malicious activity for messages sent from your domain. Set up DMARC by adding a DMARC DNS TXT record (DMARC record) to your domain. “A DMARC record is a line of text that you add to your domain, following your domain provider's instructions.” v=DMARC1; p=reject; rua=mailto:[email protected], mailto:[email protected]; pct=100; adkim=s; aspf=s
Set up DMARC “The action options are reject, quarantine, or deliver the message.” A DMARC record is a line of text that you add to your domain, following your domain provider's instructions. Here's an example DMARC record:
Set up DMARC “You can also get reports that help you identify possible authentication issues and malicious activity for messages sent from your domain.” A DMARC record is a line of text that you add to your domain, following your domain provider's instructions. Here's an example DMARC record:
v=DMARC1; p=reject; rua=mailto:[email protected], mailto:[email protected]; pct=100; adkim=s; aspf=s “When receiving servers get email messages from your domain that don't pass SPF or DKIM, they check your DMARC record to determine what action to take on the messages: Reject, quarantine, or deliver normally.” On this page
Before you begin “If you don't set up SPF and/or DKIM before enabling DMARC, messages sent from your domain will probably have delivery issues.” To check if DMARC is already set up for your domain, use one of many free tools available on the internet. If DMARC is already set up, you should review your DMARC reports to check that DMARC is effectively authenticating messages and they are being delivered as expected.
Set up DMARC “You can also get reports that help you identify possible authentication issues and malicious activity for messages sent from your domain.” A DMARC record is a line of text that you add to your domain, following your domain provider's instructions. Here's an example DMARC record:
You must turn on SPF and/or DKIM for your domain before you can use DMARC. If you haven't set up SPF and/or DKIM, go to Help prevent spoofing, phishing, and spam. If you don't set up SPF and/or DKIM before enabling DMARC, messages sent from your domain will probably have delivery issues. Allow 48 hours after setting up SPF and/or DKIM before setting up DMARC. “you should review your DMARC reports to check that DMARC is effectively authenticating messages and they are being delivered as expected.” You don't need to do anything in your Google Admin console to set up DMARC. Instead, determine your DMARC record by following the instructions on this page. Then, log into your domain host and add the DMARC record, following the domain host DMARC instructions.
Before you begin “If you don't set up SPF and/or DKIM before enabling DMARC, messages sent from your domain will probably have delivery issues.” To check if DMARC is already set up for your domain, use one of many free tools available on the internet. If DMARC is already set up, you should review your DMARC reports to check that DMARC is effectively authenticating messages and they are being delivered as expected.
Set up DMARC “DMARC tells receiving email servers what action to take on messages sent from your domain that don't pass SPF or DKIM authentication.” A DMARC record is a line of text that you add to your domain, following your domain provider's instructions. Here's an example DMARC record:
Set up DMARC “The action options are reject, quarantine, or deliver the message.” A DMARC record is a line of text that you add to your domain, following your domain provider's instructions. Here's an example DMARC record:
Step 2: Make sure third-party email is authenticated “you must make sure that messages sent by third-party services are authenticated and pass SPF and DKIM checks:” Contact your third-party provider to make sure SPF and DKIM are correctly set up.