What is DMARC? Explained in plain language
DMARC is a setting for your domain name that tells recipients what to do with email that claims to come from your domain but doesn't actually come from you. It protects you and the people you email against fake email sent in your name (spoofing and phishing) and helps your real email get delivered more reliably.
In short
- DMARC is a TXT record in your domain's DNS, named
_dmarc. - It builds on two other checks: SPF (which servers are allowed to send email on behalf of your domain) and DKIM (a digital signature on every email).
- In the DMARC record you choose a policy: do nothing, send to spam or reject.
- Major mail providers such as Gmail, Outlook and Yahoo now expect a DMARC record. Without DMARC, your email is more likely to end up in spam.
Why is DMARC needed?
Anyone can send an email with a sender that looks like your address, for example info@yourdomain.nl. The recipient won't immediately see that it's fake. Scammers use this to forge invoices or steal passwords. With DMARC you show which email really comes from you, and you ask the recipient to reject fake email or send it to spam.
How does it work?
When an email arrives with your domain as the sender, the receiving mail server checks three things:
- SPF: was the email sent from a server listed in your domain's SPF record?
- DKIM: is the digital signature that your mail server added to the email valid?
- DMARC: does the passing SPF or DKIM check actually match the domain in the sender address? If so, the email is fine. If not, the recipient follows the policy in your DMARC record.
What does a DMARC record look like?
A DMARC record is a TXT record on _dmarc.yourdomain.nl, for example:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.nl
| Part | Meaning |
|---|---|
v=DMARC1 | This is a DMARC record. Always comes first. |
p=none | "Do nothing" policy: the recipient delivers the email as normal, but you can still receive reports. This is where you start if you create a DMARC record yourself. |
p=quarantine | "Quarantine" policy: email that fails ends up in the spam folder. The second step, once the reports look good. |
p=reject | "Reject" policy: email that fails is not delivered at all. The strictest and safest setting, and the default for a WebOké hosting package. |
rua=mailto:... | Optional: an email address where you receive daily reports about who is sending email on behalf of your domain. |
Our advice: tighten it step by step
- Does all your email go through WebOké? Then your hosting package already has a DMARC record with
p=reject, and SPF and DKIM are set up correctly automatically. You can leave it as it is. - Do you also send email through other services, such as Microsoft 365, Google Workspace, a newsletter service or your accounting software, or are you creating a new DMARC record yourself? Then start with
p=noneand a report address. Check the reports for a few weeks to see whether all your own email passes the checks. After that, move top=quarantine, and if that goes well, top=reject.
In 2026 the DMARC standard was updated (RFC 9989). Your existing record will keep working. The pct= part (a percentage) is dropped in the new standard: don't use it, or leave it at 100.
How DMARC works exactly and how to read the reports is explained in the lesson DMARC: what recipients should do with fake email in the free DNS course.
Getting started step by step
- Make sure SPF is correct. If you also send email through another service, such as a newsletter program or Microsoft 365, add it to your SPF record as well. Read Adding or changing an SPF record in DirectAdmin.
- Make sure DKIM is enabled. With a WebOké hosting package, DKIM is enabled by default for email sent through our servers.
- Create the DMARC record. Start with
p=noneand a report address, move top=quarantineafter a few weeks and then top=reject. How to create the record is explained in Creating a DMARC record in DirectAdmin. You can also do this in My WebOké, under My Domains, on the DNS tab. - Check your settings. With our free Domain Health check you can see right away whether SPF, DKIM and DMARC are set up correctly. The Internet.nl checklist will also help you along.
Frequently asked questions
Will my own email be rejected if I turn on DMARC?
Not if SPF and DKIM are set up correctly. If you send email through a service that isn't in your SPF record and doesn't sign with your domain, that email may end up in spam or be rejected with p=quarantine or p=reject. That's why you should start with p=none and check the reports to see who is sending email on behalf of your domain. With a hosting package the record is set to p=reject by default: if you also send email through another service, temporarily set it to p=none until that service is properly included in SPF and DKIM.
Do I need to enter a report address?
No, that's optional. The reports are technical and mainly useful if you want to know which services are sending email on behalf of your domain. Preferably use a separate address for them, as you may receive a few every day. How to read such a report is explained in Reading a DMARC report.
I use Microsoft 365 or Google Workspace. Does DMARC work then too?
Yes. Add the service to your SPF record, enable DKIM in that service and then create the DMARC record at WebOké, or adjust the existing one. The order makes the difference: first SPF and DKIM, then DMARC. Here too, start with p=none and work your way up to p=reject step by step.
Do you have a DMARC record ready for me?
Yes. A hosting package already includes one by default: v=DMARC1;p=reject. If you create a record yourself, for example for a domain without a hosting package, start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.nl and make it stricter step by step. If you get stuck, send us a message: we're happy to help.
Detailed explanation with screenshots: Setting up DMARC in the DirectAdmin manual.