If your business sends or receives email through Gmail — whether that's a personal Gmail account or a Google Workspace domain — publishing a DMARC record for your domain is one of the most effective ways to stop scammers from impersonating you and to keep your legitimate mail out of the spam folder.
What DMARC does for your domain
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS record that tells receiving mail servers, including Gmail, what to do with messages that claim to be from your domain but fail your SPF or DKIM checks. Without it, there's no consistent instruction for handling a forged message — it might land in the inbox looking completely legitimate.
DMARC works alongside two other authentication tools you'll want in place first:
- SPF specifies which mail servers are allowed to send email for your domain.
- DKIM adds a digital signature proving a message wasn't altered after it was sent.
DMARC checks that one of these passes and that it lines up with the domain shown in the "From" address. If a message fails that check, your DMARC policy tells the receiving server whether to deliver it anyway, quarantine it as spam, or reject it entirely.
Why Gmail specifically requires this now
Google requires DMARC for any domain sending meaningful volumes of mail to Gmail addresses. Even for smaller senders, having a DMARC record in place improves how Gmail's spam filters treat your messages, since it signals that your domain takes authentication seriously.
Setting up your DMARC record
- Write your DMARC record. Every record starts with the version tag, followed by your policy and a reporting address. A monitor-only starting record looks like:
v=DMARC1; p=none; rua=mailto:[email protected] - Publish it in your DNS zone. Log in to your domain's DNS management — your Avalon hosting control panel, if Avalon manages your domain — and add a new TXT record with the host
_dmarc. - Start in monitor mode. A policy of "none" won't block or redirect any mail; it just generates reports so you can see what's happening before enforcing anything.
- Review your reports regularly. These reports show which servers are sending mail on your domain's behalf and whether they're passing authentication.
- Tighten the policy gradually. Once you've confirmed all your legitimate senders pass, move to a quarantine policy, and eventually to a full reject policy for the strongest protection.
Common issues and fixes
- DMARC fails even though SPF and DKIM look fine: usually caused by misalignment — the domain in your SPF or DKIM record doesn't match the visible "From" address. Make sure they line up.
- Record seems to have no effect: check for syntax mistakes, such as a missing semicolon, using any DMARC record validator.
- Legitimate email starts getting blocked: this typically means the policy was tightened before every sending source was verified. Step back to monitor mode and review reports again.
FAQ
Do I need a Google Workspace account for this, or does it work with any Gmail address? DMARC is set on your domain's DNS, so it protects any email sent from your domain, regardless of which mail provider you use.
How often should I check my DMARC reports? Weekly is reasonable when you're first setting things up; monthly spot-checks are usually enough once your setup is stable.
