Prerequisites
- Set Up Your Sending Domain — DMARC is part of sending domain setup
Set a DMARC Policy
The one record whose contents are yours to decide.
Before You Begin
- Access to the DNS records for your registered domain, not just the sending subdomain.
- A sending domain in setup or already configured
DKIM and SPF let a recipient test whether a message really came from your domain. DMARC is where you say what should happen when a message fails those tests — ignore it, treat it with suspicion, or refuse it outright.
Zyntro requires a DMARC record before you can activate sending, and keeps checking it afterwards from the DMARC card on the dashboard. The delivery service plays no part in this record; Zyntro reads it directly from DNS.
Unlike every other record in setup, the contents are your decision. Start by monitoring, then tighten.
Steps
Find the hostname Zyntro expects
The DMARC card shows the exact hostname, with a copy button. It is _dmarc on your registered domain rather than on your sending subdomain — so a sending domain of comms.example.com means a record at _dmarc.example.com.
A policy on the registered domain also covers its subdomains, which is why it belongs there. If your domain uses a two-part suffix such as example.co.uk, the hostname is _dmarc.example.co.uk.
Check whether you already have one
Many domains do. If a DMARC record already exists at that hostname, leave it alone — a domain should have only one. Select Verify on the card and Zyntro will confirm it.
If you see a message saying a record exists but is not a policy, something else has been published at that hostname and needs correcting.
Choose a policy
The policy is set by the p= tag, and there are three choices:
p=none— monitor only. Failing mail is treated no differently. This is where to start.p=quarantine— failing mail should be treated as suspicious, typically landing in spam.p=reject— failing mail should be refused outright.
Begin with p=none. A stricter policy published before your own mail reliably passes DKIM and SPF will cause your legitimate messages to be quarantined or refused.
Publish the record
Create a TXT record at the hostname from the card. The simplest valid starting policy is:
v=DMARC1; p=none;
Adding a reporting address is worthwhile, because it is how you learn whether your mail passes before you tighten the policy:
v=DMARC1; p=none; rua=mailto:[email protected]
The v=DMARC1 tag must come first.
Verify it in Zyntro
Select Verify on the DMARC card. Zyntro checks live DNS, and on success the card turns green and shows your policy, for example p=none.
If the record was published moments ago, give DNS time to spread and try again — this can take up to 24 hours.
Tighten the policy later
Once reports show your legitimate mail passing, move to p=quarantine, and later p=reject if you want the strongest protection against forgery of your domain.
Change the record at your DNS host, then select Verify again so the card reflects the new policy.
Result
The DMARC card shows a green tick and your current policy. Inbox providers now have your instructions for mail that fails authentication, and nobody can forge your domain without those instructions applying.
With p=none you are monitoring rather than protecting, which is the right first step but not the destination. Revisit the card once you have had time to read reports.
Troubleshooting
Something else is published at that hostname — most often an SPF value pasted into the wrong record. Replace it with a policy beginning v=DMARC1; and setting p=.
Check the order of the tags: v=DMARC1 must come first. Check the p= value is exactly none, quarantine or reject. And check the hostname — the record belongs on your registered domain, not your sending subdomain.
A policy of quarantine or reject applies to any mail failing DKIM and SPF, including mail you send through other services. Return to p=none, confirm every service that sends for your domain is authorised, then tighten again.
DMARC has to live on the registered domain, so whoever controls it must publish the record. Send them the hostname and value from the card; both have copy buttons.
