What is DMARC? Explanation in plain language
DMARC is a setting for your domain name that tells recipients what to do with email that claims to come from your domain, but doesn't really come from you. It protects you and the people you email against fake email sent in your name (spoofing and phishing) and ensures your genuine email gets delivered better.
In short
- DMARC is a TXT record in your domain's DNS, named
_dmarc. - It builds on two other checks: SPF (which servers are allowed to send mail on behalf of your domain) and DKIM (a digital signature on every email).
- In the DMARC record, you choose a policy: do nothing, mark as spam, or reject.
- Major mail providers such as Gmail, Outlook and Yahoo now expect a DMARC record. Without DMARC, your email is more likely to end up in spam.
Why is DMARC needed?
Anyone can send an email with a sender address that looks like yours, for example info@yourdomain.nl. The recipient won't immediately see that it's fake. Scammers use this to fake invoices or steal passwords. With DMARC, you show which email is really from you and ask the recipient to reject fake email or mark it as spam.
How does it work?
When an email comes in with your domain as the sender, the receiving mail server checks three things:
- SPF: was the email sent from a server listed in your domain's SPF record?
- DKIM: does the digital signature your mail server added to the email check out?
- DMARC: does the approved SPF or DKIM check actually match the domain in the sender address? If so, the email is fine. If not, the recipient follows the policy from your DMARC record.
What does a DMARC record look like?
A DMARC record is a TXT record at _dmarc.yourdomain.nl, for example:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.nl
| Part | Meaning |
|---|---|
v=DMARC1 | This is a DMARC record. Always comes first. |
p=none | "Do nothing" policy: the recipient simply delivers the email, but you can still receive reports. This is the starting point when you create your own DMARC record. |
p=quarantine | "Quarantine" policy: email that fails the check goes to the spam folder. The second step, once the reports look good. |
p=reject | "Reject" policy: email that fails the check isn't delivered at all. The strictest and safest setting, and the default for a WebOké hosting package. |
rua=mailto:... | Optional: an email address where you receive daily reports about who sends email on behalf of your domain. |
Our advice: get stricter step by step
- Does all your mail go through WebOké? Then your hosting package already has a DMARC record with
p=reject, and SPF and DKIM are already correct. You can leave it as it is. - Do you also send mail through other services, such as Microsoft 365, Google Workspace, a newsletter service, or your accounting software, or are you creating a new DMARC record yourself? Then start with
p=noneand a report address. Check the reports for a few weeks to see whether all your own mail passes the check. Then move top=quarantine, and once that's going well, top=reject.
In 2026, the DMARC standard was updated (RFC 9989). Your existing record will keep working. The pct= part (a percentage) is being removed in the new standard: don't use it, or leave it set to 100.
Step by step getting started
- Make sure SPF is correct. If you also send mail through another service, such as a newsletter program or Microsoft 365, add that to your SPF record too. Read Adding or changing an SPF record in DirectAdmin.
- Make sure DKIM is enabled. With a WebOké hosting package, DKIM is enabled by default for email sent through our servers.
- Create the DMARC record. Start with
p=noneand a report address, move top=quarantineafter a few weeks, and then top=reject. You can read how to create the record in Creating a DMARC record in DirectAdmin. You can also do it in My WebOké, under My domains, under DNS. - Check your settings. With our free email check, you can instantly see whether SPF, DKIM and DMARC are set up correctly. The Internet.nl checklist can also help you further.
Frequently asked questions
Will my own email be rejected if I turn on DMARC?
Not if SPF and DKIM are set up correctly. If you send email through a service that isn't in your SPF record and that doesn't sign with your domain, that email may end up in spam or be rejected with p=quarantine or p=reject. So start with p=none and check the reports to see who's sending mail on behalf of your domain. With a hosting package, the record is set to p=reject by default: if you also send mail through another service, temporarily set it to p=none until that service is properly set up in SPF and DKIM.
Do I need to fill in a report address?
No, that's not required. The reports are technical and mainly useful if you want to know which services send mail on behalf of your domain. It's best to use a separate address for this, since you may receive several reports a day.
I use Microsoft 365 or Google Workspace. Does DMARC still work then?
Yes. Add the service to your SPF record, enable DKIM in that service, and then create the DMARC record at WebOké, or adjust the existing one. The order matters: first SPF and DKIM, then DMARC. Here too, start with p=none and move step by step to p=reject.
Do you have a DMARC record ready for me?
Yes. With a hosting package, one is already set up by default: v=DMARC1;p=reject. If you create a record yourself, for example for a domain without a hosting package, start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.nl and make it stricter step by step. If you can't figure it out, just send us a message: we're happy to help.
Detailed explanation with screenshots: Setting up DMARC in the DirectAdmin guide.