DMARC
What is DMARC?
Domain-based Message Authentication, Reporting and Conformance (DMARC) tells receiving servers what to do with an email that claims to come from your domain but fails SPF and DKIM checks. It can let it through, put it in spam or reject it. DMARC also sends you daily reports, so you can see who is sending email using your domain.
Gmail, Yahoo and Outlook require a DMARC record. A stricter policy also shows mailbox providers that you take security seriously, which helps your deliverability.
Add a DMARC record
Do this for each cold email domain. In Cloudflare, select the domain, go to DNS > Records and add:
| Type | Name | Content |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected] |
Replace the email address with the dmarc-reports@ address you created for that domain in Google Workspace or Zoho Mail.
| Tag | Meaning |
|---|---|
v=DMARC1 | This is a DMARC record |
p=none | Policy. Don't act on failed emails yet, just report on them |
rua=mailto:... | Where to send the daily summary reports |
Make your policy stricter over time
Starting with p=none lets you check everything passes before you tell receivers to block failures. Then make it stricter while your inboxes are warming up.
Every 1 to 2 weeks, check your DMARC reports. If all your emails are passing, edit the _dmarc record and move to the next step:
| When | Policy |
|---|---|
| Day 0 (when you start warming up) | p=none |
| About day 14 | p=quarantine |
| About day 28 | p=reject |
For example, your final record would be:
v=DMARC1; p=reject; rua=mailto:[email protected]
DMARC reports are XML files that are hard to read on their own. A free service such as Postmark's DMARC monitoring or EasyDMARC turns them into a simple summary.
Only move to p=quarantine or p=reject when your reports show that all your real emails pass. If you send from other services using the same domain and they fail, those emails will be blocked.