Blog
DMARC, explained in plain English
Everything we've written about getting your domain's email authenticated and keeping it that way — setup guides, fixes for specific bounces and errors, and honest tool comparisons.
Getting set up
DMARC Setup Guide with Record ExampleA plain-English DMARC setup guide: the exact record example, how to add it at Cloudflare, GoDaddy or Namecheap, and how to roll from p=none safely.Add a DMARC Record in CloudflareAdd a DMARC record in Cloudflare DNS in two minutes: the exact record type, name and value, the quoting mistakes to avoid, and how to verify it.Add a DMARC Record in GoDaddyAdd a DMARC record in GoDaddy DNS in two minutes: the exact record type, name and value, the _dmarc host-name mistake to avoid, and how to verify.DMARC Setup for Google WorkspaceSet up DMARC on Google Workspace in four steps: verify SPF, enable DKIM in the Admin console, publish the DMARC record, then monitor your reports.DMARC Setup for Microsoft 365Set up DMARC on Microsoft 365 in four steps: verify SPF, enable custom DKIM in Defender, publish the DMARC record, then read your first reports.How to set up DMARC on Zoho Mail (step by step)Set up DMARC for Zoho Mail in four steps: verify SPF, generate a DKIM selector in the Admin Console, publish the DMARC record, then monitor it.DMARC Setup for Amazon SESSet up DMARC for a domain sending via Amazon SES: Easy DKIM CNAMEs, the custom MAIL FROM that aligns SPF, and the DMARC record to start safely.Mailgun SPF, DKIM & DMARC SetupSet up Mailgun so its mail passes DMARC for your domain: why a mg. subdomain is the right sender, the exact SPF and DKIM records, and how to verify.SPF vs DKIM vs DMARC, in Plain EnglishSPF, DKIM and DMARC each solve a different problem. A plain-English guide to what each checks, why you need all three, and how alignment ties them.SPF ~all vs -all: Softfail vs FailSPF ~all (softfail) vs -all (hardfail): what each ending tells receivers, why it matters for delivery, and which one to actually use.What Is a DKIM Selector, and How to Find ItA DKIM selector is the label telling receivers which public key to fetch. How to find yours in the message headers and look up the DNS record.DMARC p=none vs p=quarantine vs p=rejectWhat p=none, p=quarantine and p=reject actually do, the risks of moving too fast (or never moving), and a safe checklist for tightening your DMARC policy.DMARC for Subdomains: the sp= TagSubdomains inherit your DMARC policy unless you set sp=. How the sp= tag works, when to override it, and the forgotten subdomains spoofers exploit.How to Read DMARC Reports (XML Example)How to read a DMARC aggregate report in plain English: a real XML example explained — source_ip, count, disposition, and the SPF and DKIM results.DMARC ruf= Forensic Reports: Why You Get NoneYou added ruf= but almost nothing arrives. Why DMARC forensic reports are rare, which providers still send them, and what to do instead.Gmail & Yahoo Bulk Sender Requirements 2026The Google, Yahoo and Microsoft bulk sender rules for 2026: SPF, DKIM, DMARC, an aligned From, one-click unsubscribe and the spam-rate threshold.Fixing problems
Why DMARC Fails and How to Fix Itdmarc=fail even though SPF and DKIM look right? The real causes in plain English — alignment, forwarding, provider-domain DKIM — and how to fix each.Fix DKIM "body hash did not verify"DKIM 'body hash did not verify' means the message body changed after it was signed. The real causes — footers, forwarding, encoding — and the fixes.Fix Gmail 550-5.7.26 unauthenticated errorGmail 550-5.7.26 error: fix "this mail is unauthenticated". Plain-English steps to set SPF, DKIM, and DMARC so Gmail stops rejecting your mail.Fix Outlook 550 5.7.515 authentication errorOutlook bounced your mail with 550 5.7.515? Plain-English steps to set SPF, DKIM and DMARC so it meets the required authentication level.Not Receiving DMARC Reports? 6 FixesPublished a DMARC record but no aggregate reports arrive? The 6 common causes — missing rua, typos, unauthorized external destinations — and fixes.SPF PermError: Too Many DNS LookupsSPF PermError 'too many DNS lookups' means your record passes the 10-lookup limit. How to count your lookups, trim includes, and fix it for good.Fix SendGrid & Mailchimp DMARC alignment failsPassing SPF and DKIM but still failing DMARC? That's alignment. How to enable domain authentication for SendGrid, Mailchimp and similar platforms.For agencies, agents, and tool shoppers
DMARC Monitoring for Agencies at ScaleHow agencies monitor DMARC across many client domains: what breaks past 10 domains, and how white-label weekly reports turn it into a service.Team seats: add your whole team to PlainDMARCInvite teammates to PlainDMARC with full, admin, or view-only access. Seats scale by plan — 1 Free, 2 Solo, 5 Agency, 10 Agency+ — leak-proof scoping.Manage DMARC with an AI Agent via APIPlainDMARC is operable end-to-end by an AI agent: free keyless JSON DMARC checks, llms.txt API docs, and per-account Bearer keys scoped to one account.DMARC MCP Server for AI Agentsplaindmarc-mcp is a read-only MCP server with seven tools — DMARC, SPF, DKIM, BIMI and MTA-STS checks plus DMARC record generation — for AI agents.dmarcian for Agencies: When It Fits, When to Switch (2026)An honest look at dmarcian for agencies: where it fits, where it doesn't, and when to switch to flat-price white-label DMARC monitoring. Full side-by-side on our compare page.EasyDMARC for Agencies: When It Fits, When to Switch (2026)An honest look at EasyDMARC for agencies: where it fits, where it doesn't, and when to switch to flat-price white-label DMARC monitoring. Full side-by-side on our compare page.Reading is optional
Run a free check on your domain and get a plain-English verdict right now, no signup needed.