Domain Creation Wizard
The next steps are a DMARC record creation process.
Select the domain for which you intend to create the record.
If you already have a published DMARC record and want to use its values, enable the discovery option.
By default, if no existing values are found, default values are used. If you want to customize options you can deselect relative option and follow record wizard steps.
Autodiscovery / Default values
Manual record creation
Policy
First and foremost, there are three policies:
- No effect: This is the entry-level policy. No special treatment is required by receivers but enables a domain to receive feedback reports.
- Flag as quarantined: asks receivers to treat messages that fail DMARC check with suspicion. Different receivers have different means to implement that, for example, flag messages or deliver them to the spam folder.
- Reject the messages: asks receivers to outright reject messages that fail the DMARC check.
Alignment
DMARC operates by checking that the domain in the messages From field (also called "RFC5322").
From is "aligned" with other authenticated domain names, if either SPF or DKIM alignment checks pass, then the DMARC alignment test passes.
Alignment may be specified as strict or relaxed. For strict alignment, the domain names must be identical. For relaxed alignment, the top-level "Organizational Domain" must match.
The Organizational Domain is found by checking a list of public DNS suffixes and adding the next DNS label.
So, for example, "a.b.c.d.example.com.au" and "example.com.au" have the same Organizational Domain because there is a registrar that offers names in ".com.au" to customers.
Although at the time of DMARC spec, there was an IETF working group on domain boundaries, nowadays the organizational domain can only be derived from the Public Suffix List.
Sub-domains
- Not set: This means you want to same the same as your main domain
- None: this is the entry-level policy. No special treatment is required by receivers but enables a domain to receive feedback reports.
- Quarantine: asks receivers to treat messages that fail DMARC check with suspicion. Different receivers have different means to implement that, for example, flag messages or deliver them to the spam folder.
- Reject: asks receivers to outright reject messages that fail the DMARC check.
In the Sub Domains screen, select your Sub Domain Policy and click Next
Percentage
The DMARC Percentage tag policy is used to tell receiving mail service what percentage of emails that fail DMARC validation should be blocked. The value that you choose in the Percentage block can be anywhere from 1% to 99%.
The value of only blocking a small percentage of email that fails DMARC is that it allows you to gradually test quarantining emails.
You can specify the percentage of emails affected by the policy in phase 2, and slowly increase the percentage to 100% to make the deployment complete. The important aspect is to monitor the email reports regularly to ensure that valid emails are not rejected or affected.
In the percentage screen, set what percentage of emails you want to apply this policy and click Next.
Summary
In the Summary screen, review Your DMARC record and click Show record.
Publish
After the last step, you will be redirected to a specific page where you will choose how to publish the record to your DNS.