add a DMARC record to the DNS

Ray Zabielski 20 Reputation points
2026-10-23T20:41:57.38+00:00

I need to log in and add a DMARC record to the DNS. How is that done?

Microsoft 365 and Office | Subscription, account, billing | For business | Other
Answer accepted by question author
Niklas Tageby 80 Reputation points
2026-10-26T15:54:41.66+00:00

Hi Ray,

Chris-D has already provided the steps needed to configure your DMARC record.

Just make sure you're making the changes at the DNS provider hosting your domain's authoritative DNS records, which may be different from Microsoft 365.

One additional recommendation: If you're planning to enable DMARC reporting using the rua tag, consider using a DMARC monitoring service such as Valimail instead of sending raw XML reports directly to a regular mailbox.

This can make it much easier to identify legitimate email sources, monitor authentication results, and safely move toward a stronger DMARC policy over time.

For now, starting with p=none is a reasonable approach while validating your email configuration.

Hope this helps and have a great day!

BR,

Niklas T

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chris-D 2,625 Reputation points Independent Advisor
    2026-10-23T21:10:59.23+00:00

    Hi Ray,

    Thank you for sharing your concern.

    If you are using a custom domain, such as yourdomain.com, you will need to sign in to the provider that currently hosts your domain’s DNS, such as GoDaddy, Cloudflare, Namecheap, or another DNS provider.

    After signing in, go to DNS Management, Manage DNS, or Zone Editor, and add the following TXT record:

    • Record type: TXT
    • Name/Host: _dmarc
    • Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com
    • TTL: 3600 seconds, 1 hour, or the default value

    Replace ******@yourdomain.com with a valid mailbox that can receive DMARC reports. Some DNS providers automatically add your domain name, so you may only need to enter _dmarc in the Name or Host field.

    Once the record has been saved, allow some time for the DNS change to propagate.

    Starting with p=none allows you to monitor DMARC results without instructing receiving mail systems to quarantine or reject messages. After confirming that all legitimate email sources are properly authenticated through SPF or DKIM, you may consider changing the policy to p=quarantine and eventually p=reject.

    If you are configuring an onmicrosoft.com domain instead, please follow these steps:

    1. Sign in to the Microsoft 365 Admin Center with your admin account.
    2. Go to Show all > Settings > Domains.
    3. Select your onmicrosoft.com domain.
    4. Open DNS records and select Add record.
    5. Select TXT as the record type.
    6. Enter _dmarc as the TXT name.
    7. Enter the required DMARC value, then save the record.

    For detailed guidance, you may find these articles helpful:

    I hope this information is helpful. Should you have any further questions or need additional assistance, please feel free to share them in the comment below. I'm very happy to help.  

    If the answer is helpful, please click 'Yes' and kindly upvote it. 

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-23T20:42:32.8533333+00:00

    For a custom business domain, sign in to the service hosting its authoritative DNS—not normally Microsoft 365—and create a TXT record named _dmarc; only *.onmicrosoft.com DMARC records are added directly in the Microsoft 365 admin center.^1^

    Custom domain, such as contoso.com

    1. Identify the company hosting your DNS—often the domain registrar or a provider such as GoDaddy, Cloudflare, or Azure DNS.
    2. Sign in to that provider and open DNS Manager, Manage DNS, or Zone File Settings.
    3. Add this record:
      Field Value
      Type TXT
      Name/Host _dmarc
      Value v=DMARC1; p=none; rua=mailto:[Email]
      TTL 3600 seconds / 1 hour
    4. Replace [Email] with a real mailbox that can receive aggregate DMARC reports.
    5. Save the record.

    Start with p=none to collect reports without requesting that receiving systems quarantine or reject failing messages. Review the reports and ensure legitimate senders pass aligned SPF or DKIM before changing the policy to p=quarantine and eventually p=reject. A message passes DMARC when aligned SPF or DKIM passes; enforcing too early can affect legitimate mail.^1^

    Some DNS providers automatically append the domain name. In that case, enter only _dmarc, not _dmarc.contoso.com.

    Microsoft 365 doesn't provide a portal or PowerShell command for managing DMARC records on custom domains; the record must be created at the authoritative DNS provider.^1^

    onmicrosoft.com domain

    For a domain such as contoso.onmicrosoft.com:

    1. Sign in to the Microsoft 365 admin center.
    2. Select Show all → Settings → Domains.
    3. Select the contoso.onmicrosoft.com domain.
    4. Open DNS records → Add record.
    5. Enter:
      • Type: TXT (Text)
      • TXT name: _dmarc
      • TXT value: v=DMARC1; p=reject
      • TTL: 1 hour
    6. Select Save.^1^

    Verify the published record

    After DNS propagation, run:

    nslookup -type=TXT _dmarc.contoso.com

    The response should contain the DMARC value you saved. There should be only one DMARC TXT record at that name; combine all required DMARC tags into that single record.

    References

    1. Set up DMARC to validate the From address domain for cloud senders
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.