Set up DMARC - Google Workspace Admin Help (2024)

As an administrator, once you have SPF and DKIM set up, you can set up Domain-based Message Authentication, Reporting, and Conformance (DMARC). DMARC lets you tell receiving mail servers what to do when they get a message that doesn't pass SPF or DKIM authentication checks. You can also get reports that help you identify possible authentication issues and malicious activity for messages sent from your domain.

On this page

• Step 2: Check if DMARC is already set up
• Step 3: Set up a group or mailbox for reports
• Step 4: Ensure any third-party services are authenticated
• Step 5: Prepareyour DMARC record
• Step 6: Add your DMARC record
• Step 7: Verify your DMARC record
• Related topics

Step 1: Turn on SPF & DKIM

Before you can use DMARC, you must turn on SPF and DKIM for your domain. If you haven't set up SPF and DKIM, go to Help prevent spoofing, phishing, and spam.

SPF, DKIM, and DMARC are applied per domain. If you manage more than one domain, you must enable SPF, DKIM, and DMARC separately for each domain.

Important:

• If you don't set up SPF and DKIM before enabling DMARC, messages sent from your domain will probablyhave delivery issues.
• Allow 48 hours after setting up SPF and DKIM before setting up DMARC.

Step 2: Check if DMARC is already set up

If you're using Google Workspace, use the Google Admin Toolbox to check if DMARC is set up. Otherwise, follow the steps for checking at your domain provider.

Check using the Google Admin Toolbox:

1. Go to the Google Admin Toolbox.
2. Go to Verify DNS issuesCheck MX.
3. Enter your domain name in the Domain name field, then click RUN CHECKS!
4. The results indicate whether your domain has a DMARC record:
   • DMARC is not set up—Your domain doesn’t have a DMARC record yet.
   • Formatting of DMARC policies—Your domain has an existing DMARC record.

Check at your domain provider:

1. Sign into the management console for your domain provider.
2. Locate the page or dashboard where you update your domain’s DNS TXT records.
3. Check the DNSTXT records for your domain. If your domain has a DMARC record, there's a TXT record entry that starts with v=DMARC.

Proceed based on the results:

• If DMARC is already set up, you should review your DMARC reports to make sure DMARC is effectively authenticating messages and they are being delivered as expected.
• If DMARC is not set up, proceed to Set up a group or mailbox for reports(on this page).

Step 3: Set up a group or mailbox for reports

The number of DMARC reports you receive by email can vary, and depends on how much email your domain sends. You can receive many reports every day. Large organizations might get up to hundreds or even thousands of reports daily.

Google recommends that you create a group or a dedicated mailbox to receive and manage DMARC reports.

DMARC reports tell you which messages sent from your domain are authenticated by SPF and DKIM and if any messages are regularly failing authentication. You can also use reports to review who is sending mail for your domain, and get alerted to potential spammers. Monitoring DMARC reports is especially helpful during the rollout phase. See Recommended DMARC rollout.

Step 4: Ensure any third-party services are authenticated

If you use a third-party service to send mail for your organization, you must ensure that messages sent by third-party services are authenticated and pass SPF and DKIM checks:

• Contact your third-party provider to make sure DKIM is correctly set up.
• Make sure the provider’s envelope sender domain matches your domain. Add the IP address of the provider’s sending mail servers to the SPF record for your domain.
• Route outgoing mail from the provider through Google using the SMTP relay service setting.

Step 5: Prepare your DMARC record

Your DMARC policy is defined in a line of text values calleda DMARC record. The record defines:

• How strictly DMARC should check messages
• Recommended actions forthe receiving server, when it gets messages that fail authentication checks

Example of a DMARC policy record (replace example.com with your domain):

v=DMARC1; p=reject; rua=mailto:postmaster@example.com, mailto:dmarc@example.com; pct=100; adkim=s; aspf=s.

The v and p tags must be listed first. Other tags can be listed in any order.

When you start using DMARC, we recommend setting the policy option (p) to none. As you learn how messages from your domain are authenticated by receiving servers, update your policy. Over time, change the receiver policy to quarantine (orreject).SeeRecommended DMARC rollout.

Step 6: Add your DMARC record

After preparing the text of your DMARC record, add or update the DMARC DNS TXT record at your domain provider. Anytime you change your DMARC policy and update your record, you must also update the DMARC TXT record at your domain provider.

Add or update your record

Important: Make sure you set up DKIMand SPFbefore setting up DMARC. DKIM and SPF should be authenticating messages for at least 48 hours before turning on DMARC.

1. Have the text file or line for your DMARC recordready.
2. Sign in to your domain host,typically where you purchased your domain name. If you’re not sure who your domain host is, seeidentify your domain registrar.
3. Go to the page where you update DNS TXT records for your domain. For help finding this page, check the documentation for your domain.

4. Add or update the TXT record with this information:

   Field name	Value to enter
   Type	The record type is TXT.
   Host	The domain (or subdomain), can also be called Name, Hostname, or Alias. If the Host is the same domain (not subdomain) you are adding the TXT record to, specify the @ symbol.
   Value	The string that makes up the TXT record: for SPF, see Prepare your SPF record for DKIM, see Generate a DKIM key pair for DMARC, see Prepare your DMARC record for BIMI, see Add a BIMI TXT record
   TTL (only SPF & BIMI)	The Time To Live value determines the number of seconds before subsequent changes to the record go into effect. You can set this value to 1 hour or 3600 seconds. If your domain doesn't let you modify the value for this field, use the current value.

   Note:Some domain hosts automatically add the domainname. After you add or update the TXT record, verify the domain name in the DMARCrecord to make sure it's formatted correctly

5. Save your changes.
6. Ifyou are setting up DMARC for more than one domain, complete these steps for each domain. Each domain can have a different policy and different report options, as defined in the record.

Step 7: Verify your DMARC record

Important: The domains used in the steps below are examples only. Replace these example domains with your own domains.

Some domain hosts automatically add your domain name to the end of the TXT record name. This can cause the DMARC TXT record name to be incorrectly formatted.For example, if you enter_dmarc.example.com and your domain host automatically adds your domain name, the TXT record name will be incorrectly formatted as _dmarc.example.com.example.com.

After adding the DMARC TXT record according to the steps inAdd or update your record, check the TXT record name to verify it's formatted correctly.

In the Google Admin Toolbox, you can use the Dig feature to see and verify your DMARC TXT record:

1. Go to the Google AdminToolbox and select the Dig feature.
2. In the Name field, enter _dmarc. followed by your complete domain name. For example, if your domain name is example.com, enter _dmarc.example.com.
3. Below the Name field, click TXT.
4. Verify your DMARC TXT record name in the results. Look for the line of text that starts with _dmarc.

Related topics

• Troubleshoot DMARC issues
• Recommended DMARC rollout
• Turn off DMARC
• About DMARC reports
• About TXT records
• DMARC RFC 7489

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companieswith which they are associated.}