DMARC
Publish a DMARC policy for your domain.
DMARC tells receiving servers what to do with email that claims to come from your domain but fails authentication, and where to send reports about it. Gmail, Yahoo and other large providers expect bulk senders to publish a DMARC record.
DMARC is recommended, not required: a domain verifies without it.
How usend passes DMARC
DMARC passes when SPF or DKIM passes and is aligned with the domain in your From address. Emails sent through usend pass both ways:
- DKIM: messages are signed with your domain's own key (
rs1._domainkey), so the signature domain is your domain. - SPF: the return path is a subdomain of your domain (
send-ses.acme.com), which aligns with your domain in DMARC's default relaxed mode.
Publish a record
usend suggests a monitoring-only policy:
| Name | Type | Value |
|---|---|---|
_dmarc | TXT | v=DMARC1; p=none; |
p=none asks receivers to report but not to act, which is a safe start. Once you know that all the services sending as your domain are authenticated, you can tighten the policy, for example to p=quarantine and then p=reject. You can add a rua=mailto:... tag to receive aggregate reports at an address you choose.
If your domain already has a DMARC record, keep it: you only need one. usend accepts any TXT record at _dmarc that starts with v=DMARC1, and Auto-configure never replaces an existing policy.
A strict policy (p=reject) also applies to everything else that sends as your domain, such as your mailbox provider or other tools. Make sure they are authenticated before you tighten it.